Threat actors are actively attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. These vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, can be chained together to forge SAML responses and gain administrative access to affected WordPress sites.
The miniOrange SAML SSO plugin, developed by Xecurify, transforms a WordPress site into a SAML service provider, enabling users to authenticate via corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin. The plugin family includes a free version with 10,000 downloads and six paid editions serving 30,000 customers.
CVE-2026-61979 arises because the plugin accepts the signature algorithm from incoming SAML responses rather than enforcing a configured one. This allows an attacker to specify HMAC-SHA1, causing the plugin to interpret the identity provider's (IdP) RSA public key as a shared secret. Since the public key is publicly known, an attacker can then forge a signature that the plugin accepts as valid.
The second vulnerability, CVE-2026-15981, further compounds the issue by causing the plugin to erroneously interpret an OpenSSL verification error (-1) as a successful validation. This allows malformed signatures to bypass the validation process.
Security firm Patchstack reported that these two vulnerabilities were publicly disclosed and patched in July. However, the vendor's advisory initially focused solely on the free edition, leaving users of the six paid editions unaware of the risks, despite fixes being available for those versions as well. This oversight reportedly led many sites running paid editions to delay patching, creating an opportunity for attackers.
The following versions include fixes for the vulnerabilities: Free, single site 5.4.5; Premium, single site 13.0.4; Standard, single site 17.06; Premium/Enterprise/All-Inclusive, multisite 20.2.8; Enterprise/All-Inclusive, single site 26.0.3; VIP, single site 32.0.8; and VIP, multisite 35.0.7.
On August 16, DigitalOcean detected and blocked an unauthorized WordPress administrator session originating from outside its trusted network. An investigation revealed that attackers had successfully chained the two flaws to obtain an admin session cookie through the Standard edition plugin, specifically version 16.1.9.
Patchstack's data indicates ongoing exploitation attempts and opportunistic scanning originating from six distinct IP addresses across Europe, Africa, and the United States. A publicly available proof-of-concept (PoC) exploit targeting the free edition could accelerate the pace of attacks.
Website owners using the miniOrange SAML SSO plugin are advised to manually upgrade to a patched release, as the WordPress administrator dashboard may not display update warnings for the paid versions of the plugin.
