Attackers exploit miniOrange SAML SSO plugin vulnerabilities in WordPress

A silent patching oversight leaves paid versions of the miniOrange SAML 2.0 Single Sign On plugin vulnerable to authentication bypasses that grant administrative access.

August 27, 2026 · WordPress, SAML, Authentication Bypass, Xecurify, miniOrange

Administrators using the miniOrange SAML 2.0 Single Sign On plugin by Xecurify must manually update to patched versions immediately. Two critical vulnerabilities, CVE-2026-61979 and CVE-2026-15981, allow unauthenticated attackers to forge SAML responses and gain administrative access to WordPress sites. These flaws can be chained together to bypass authentication entirely, even when using enterprise identity providers like Microsoft Entra ID, Okta, Google Workspace, or OneLogin.

Technical breakdown of the vulnerabilities

CVE-2026-61979 (CVSS 8.1) is a privilege escalation flaw caused by signature algorithm confusion. The plugin accepts the signature algorithm from incoming SAML responses rather than enforcing the configuration set by the administrator. Attackers can exploit this to select HMAC-SHA1, which causes the plugin to treat the identity provider’s (IdP) RSA public key as a shared secret. Because these public keys are publicly accessible, an attacker can generate a forged signature that the plugin validates as authentic.

CVE-2026-15981 (CVSS 9.8) provides a direct authentication bypass due to a loose boolean check in the mo_saml_validate_signature() function. When PHP’s openssl_verify() encounters an error, it returns -1. However, the plugin evaluates this integer as “truthy,” treating a failed verification as a success. According to CVE.org, this allows attackers to submit a crafted SAMLResponse containing a malformed signature and an attacker-controlled NameID. The system then calls wp_set_auth_cookie() for the targeted account without proper validation.

Evidence of active exploitation

Security firm Patchstack has identified ongoing opportunistic scanning and exploitation attempts originating from six IP addresses: * 207.211.214.41

• 79.127.224.14
• 102.91.71.83
• 162.243.116.148
• 84.201.6.54
• 64.225.25.188

These attacks are being launched from across Europe, Africa, and the United States. Patchstack notes that these appear to be opportunistic rather than targeted, as the exploit is being thrown at any site running the plugin regardless of edition or version.

DigitalOcean discovered a real-world instance of this exploitation after detecting an anomalous WordPress administrator session originating from outside its trusted network. The investigation revealed that attackers had successfully used the bypass to obtain an admin session cookie for a site running the Standard edition of the plugin in version 16.1.9. While the attacker was eventually stalled because the specific admin panel operations were restricted behind DigitalOcean’s internal network, the initial authentication breach was successful.

The risk of silent patching

While Xecurify released fixes for all editions of the plugin in July, a significant communication gap exists. According to Patchstack and SecurityWeek, the vendor only issued an advisory regarding the free edition (fixed in version 5.4.5). No alerts were sent to users of the six paid versions.

This creates a “silent patch” scenario where many site owners may remain unaware that they are vulnerable. Furthermore, because these editions use different versioning systems, WordPress dashboard update warnings will not appear for paid versions. Site owners must manually verify their version numbers and perform manual upgrades to ensure protection.

Required updates by edition

Users should verify their current plugin version and upgrade to the following minimum releases:

• Free (single site): 5.4.5
• Premium (single site): 13.0.4
• Standard (single site): Version discrepancy exists between sources; BleepingComputer reports version 17.06, while The Hacker News cites versions 17.0.5 and 17.0.6.
• Premium/Enterprise/All-Inclusive (multisite): 20.2.8
• Enterprise/All-Inclusive (single site): 26.0.3
• VIP (single site): 32.0.8
• VIP (multisite): 35.0.7

Impact and next steps

Once an attacker successfully bypasses authentication using these flaws, they gain the same privileges as a legitimate administrator. Patchstack notes that once valid credentials are obtained, overall prevention scores drop sharply; only 37% of subsequent actions are blocked by standard defenses.

Security teams should monitor for any unauthorized SAML responses or unusual login attempts from unknown IP addresses. Because a proof-of-concept (PoC) exploit targeting the free edition is already public, the frequency of automated scanning is expected to increase.