Two critical authentication bypass vulnerabilities, both rated CVSS 9.8, in the miniOrange SAML 2.0 Single Sign On WordPress plugin were actively exploited before public vulnerability databases accurately reflected the affected paid editions. These flaws, identified as CVE-2026-61979 and CVE-2026-15981, allowed unauthenticated attackers to forge SAML authentication responses and gain administrative access to WordPress sites.
CVE-2026-61979 is an algorithm confusion vulnerability. The plugin would trust an incoming SAML response to declare its own signature algorithm. Attackers could set this algorithm to HMAC-SHA1, causing the plugin to incorrectly use the identity provider's public RSA key as the HMAC secret. Since the RSA public key is openly available, attackers could fetch it from the metadata endpoint, sign their forged assertion, and have it verified as legitimate by the plugin.
The second vulnerability, CVE-2026-15981, stemmed from a PHP coding error in how the `openssl_verify()` function's return values were handled. This function can return 1 for a valid signature, 0 for an invalid one, and -1 if OpenSSL encounters an error. The plugin treated these results as a simple true-or-false boolean. In PHP, -1 evaluates to true, meaning an attacker could craft a signature that caused an OpenSSL error, leading the function to return -1, which the plugin then interpreted as a valid signature, granting access.
A significant challenge arose from the miniOrange SAML plugin's distribution model. While listed under a single WordPress slug, "miniorange-saml-20-single-sign-on," it encompasses seven distinct product editions, each with its own independent version numbering. The Free edition ranges from 3.x to 5.x, Premium from 11.x to 13.x, Standard from 15.x to 17.x, and VIP editions starting at 32.x and 35.x. No two editions share a version range.
When initial public advisories were released, they primarily focused on the Free edition, which is downloadable from WordPress.org, with a fix landing in version 5.4.5. However, this created a critical blind spot for paid editions. Because paid installations carried higher version numbers than 5.4.5 (e.g., 16.1.9), vulnerability scanners and dashboards incorrectly reported them as already patched. Consequently, administrators of sites running vulnerable paid editions were led to believe their systems were secure, even while exploitable code remained active.
Further complicating matters, WordPress's built-in update mechanism does not automatically offer cross-line version jumps. For instance, a site running a vulnerable Standard edition 16.x would not see an available update to the patched 17.x line in its admin panel. This necessitated a manual plugin upload to apply the fix, a step site owners were unlikely to take if they were unaware of the vulnerability, given that all their security indicators suggested no issues.
The exploitation was ultimately detected by DigitalOcean, not through conventional vulnerability scanning or plugin version checks, but via network anomaly detection. An authenticated WordPress administrator session attempt originating from outside their trusted network perimeter was blocked. The attacker had already successfully used one of the authentication bypasses to generate a valid admin session cookie, but the session was halted because the admin panel itself was restricted to trusted network ranges, demonstrating the effectiveness of defense-in-depth strategies.
DigitalOcean subsequently traced both vulnerabilities to specific code lines within the plugin and its bundled XML security library. They confirmed the affected version ranges across all seven paid editions, information miniOrange had not publicly disclosed. DigitalOcean then developed two temporary hotfixes and provided a comprehensive analysis to Patchstack for publication. Patchstack collaborated with miniOrange to compile the complete edition and version matrix, then updated its database to include all seven affected ranges, marking the first time this critical information was publicly available.
Attackers are currently scanning miniOrange SSO endpoints from IP addresses located in Belgium, Nigeria, the U.S., and Germany. This activity appears opportunistic, with attackers checking websites using the plugin without first identifying specific versions or editions.
