Hackers are actively exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On (SSO) plugin for WordPress. These flaws allow attackers to forge SAML responses and gain administrative access to affected websites, posing a severe risk to WordPress administrators relying on the plugin for corporate identity integration.
Overview of miniOrange SAML SSO Plugin Authentication Bypass
The miniOrange SAML SSO plugin transforms a WordPress site into a SAML service provider, enabling users to log in via corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin. This streamlines authentication by removing the need for separate WordPress credentials. The vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, can be chained together to achieve a complete authentication bypass, leading to full administrative control of the WordPress site. Patchstack observed exploitation attempts and opportunistic scanning underway, originating from various IP addresses across Europe, Africa, and the United States, confirming the immediate threat, according to BleepingComputer.
Technical Details: Chaining Critical miniOrange SAML SSO Vulnerabilities
The first vulnerability, CVE-2026-61979, arises because the miniOrange SAML SSO plugin accepts the signature algorithm from incoming SAML responses instead of enforcing a configured one. This allows an attacker to specify HMAC-SHA1. Crucially, the plugin then treats the RSA public key of the identity provider (IdP) as the shared secret for this algorithm. Since the IdP’s public key is, by nature, publicly known, an attacker can readily forge a signature that the plugin will accept as legitimate.
The second vulnerability, CVE-2026-15981, compounds this issue by causing the plugin to misinterpret an OpenSSL verification error (-1) as a successful result. This allows malformed or deliberately crafted invalid signatures to pass validation checks. By chaining these two flaws, attackers can bypass the SAML authentication process entirely, creating a valid administrative session cookie and gaining full control over the WordPress site. An example of this chain was observed by Patchstack on August 16, where attackers obtained an admin session cookie through the Standard edition plugin in version 16.1.9 on a DigitalOcean-hosted WordPress instance.
Both vulnerabilities were publicly disclosed and fixed in July. However, the initial vendor advisory only covered the free edition of the plugin. Xecurify, the creator of miniOrange, offers seven plugins in total, with the SAML SSO plugin having a free version with 10,000 downloads and six paid versions used by 30,000 customers. While fixes were provided for the paid editions, the lack of a public alert left many sites running these versions unpatched, creating a significant window of opportunity for threat actors. A proof-of-concept (PoC) exploit specifically targeting the free edition is also publicly available, indicating that the pace of attacks exploiting these vulnerabilities could escalate rapidly.
Actionable Recommendations for WordPress Defenders
WordPress administrators using the miniOrange SAML SSO plugin must prioritize immediate action to protect their sites. The vendor’s failure to adequately disclose the risk across all versions means many sites remain vulnerable.
- Immediate Manual Updates: Website owners must manually upgrade their miniOrange SAML SSO plugin to a patched release. Update warnings will not appear for paid versions within the WordPress administrator dashboard. Ensure all instances, both free and paid, are updated to versions that address CVE-2026-61979 and CVE-2026-15981. The following versions specifically addressed the flaws:
- Free Edition: Update to a version patched in July.
- Paid Editions: Update to version 16.1.10 or higher for the Standard Edition, and corresponding patched versions for other paid editions.
- Monitor for Anomalous Activity: Implement strong logging and monitoring for unusual administrative sessions or login attempts. Look for activity originating outside trusted networks, similar to the DigitalOcean incident. Understanding how to detect miniOrange SAML SSO plugin exploitation is key to early incident response.
- Review Access Logs: Scrutinize SAML authentication logs for any signs of forged signatures, unexpected authentication bypass attempts, or OpenSSL verification errors that might indicate an active attack or a past compromise.
- Enforce Least Privilege: Ensure that even if an attacker gains initial access, their ability to move laterally or inflict further damage is limited by adhering to the principle of least privilege for all user accounts.
Addressing the potential for a miniOrange SAML SSO admin bypass requires diligence beyond typical WordPress update procedures. Proactive manual updates and enhanced monitoring are essential to mitigate this critical threat.
Related: CVE-2026-8732: WP Maps Pro Admin Creation Vulnerability Exploited, CVE-2024-3300: Critical Everest Forms Pro Bypass Leads to Site Takeover