WordPress Attacks: Two Vulnerabilities in miniOrange SAML SSO Plugin Allow Administrator Access

A Double Bypass in SAML Authentication

On August 24, 2026, it was disclosed that malicious actors are attempting to exploit two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The flaws, identified as CVE-2026-61979 and CVE-2026-15981, can be chained together to gain administrator privileges without any credentials. The plugin is developed by Xecurify and belongs to a family of seven editions: one free version with about 10,000 downloads and six paid versions totaling 30,000 customers.

The plugin turns WordPress into a SAML Service Provider. It allows users to log in through enterprise identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin, instead of using separate WordPress credentials. The weakness lies precisely in how the plugin verifies incoming SAML responses.

How the Attack Works: HMAC-SHA1 and an OpenSSL Error

CVE-2026-61979 concerns the handling of the signature algorithm. The plugin accepts the algorithm specified in the SAML response instead of enforcing the configured one. An attacker can select HMAC-SHA1, tricking the plugin into treating the Identity Provider's RSA public key as a shared secret. Because the public key is known, the attacker can forge a valid signature. This flaw has a CVSS score of 8.1.

CVE-2026-15981 stems from a faulty behavior in cryptographic verification. The plugin interprets an OpenSSL error, the value -1, as a positive outcome. A malformed signature thus passes validation. Industry databases assign this vulnerability a CVSS score of 9.8, the highest. By chaining the two flaws, an unauthenticated attacker can completely bypass authentication and gain administrator privileges.

Affected Versions and Patches

The vulnerabilities were fixed with patches released in July. The versions that resolve the issues for each edition are as follows:

Edition	Fixed Version
Free, single site	5.4.5
Premium, single site	13.0.4
Standard, single site	17.06
Premium/Enterprise/All-Inclusive, multisite	20.2.8
Enterprise/All-Inclusive, single site	26.0.3
VIP, single site	32.0.8
VIP, multisite	35.0.7

The vendor's official advisory covered only the free edition. The six paid editions received no notice, even though patches were available. The WordPress administration dashboard does not show update notifications for the paid versions. Site owners must manually check the installed version.

Why Paid Customers Are More Exposed

Without automatic alerts, many sites running paid editions have not applied the updates. An attacker exploiting the two flaws takes full control of the site: modifies content, installs malware, steals data. Trust in the SSO flow is undermined. Furthermore, a public proof-of-concept for the free edition is already available. This can quickly increase the intensity of attacks, because it provides a base to adapt to other versions.

Ongoing Exploitation Activity

Patchstack reports exploitation attempts and scans from six IP addresses distributed across Europe, Africa, and the United States. On August 16, DigitalOcean blocked an anomalous WordPress administrator session originating from outside its trusted network. The investigation showed that the attackers had chained the two flaws to obtain an administrator session cookie, exploiting version 16.1.9 of the Standard edition.

How to Mitigate the Risk

Anyone using the miniOrange SAML 2.0 Single Sign On plugin must immediately update to the fixed version indicated for their edition. Because the WordPress dashboard does not alert for paid editions, it is essential to manually verify the installed version. Logs should be monitored for anomalous administrator sessions, access from unexpected IPs, or unauthorized changes. Using a Web Application Firewall with specific rules for these CVEs can block exploitation attempts. If the update cannot be applied immediately, it is advisable to temporarily disable the SSO plugin or apply additional authentication controls.

At present, there are no public indications that the two CVEs have been added to CISA's KEV catalog.