Attackers are actively exploiting critical vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin. The flaws allow unauthenticated attackers to bypass authentication and sign in as any WordPress user, including administrators. CVE-2026-61979 carries a CVSS score of 8.1 and is classified as an unauthenticated privilege escalation vulnerability. The vulnerabilities were disclosed by Patchstack. Active exploitation attempts have been observed in the wild, making this a high-priority patching concern for WordPress site administrators using this plugin. The flaws are particularly dangerous as they require no prior authentication to exploit, lowering the barrier for attackers significantly.
Two severe unauthenticated authentication bypass vulnerabilities exist in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin. CVE-2026-61979 (CVSS 8.1) is caused by signature algorithm confusion enabling unauthenticated privilege escalation. CVE-2026-15981 (CVSS 9.8) stems from the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and treated as a successful signature verification. An unauthenticated attacker can craft a SAMLResponse with a deliberately malformed signature containing an attacker-controlled NameID, triggering an OpenSSL processing error that bypasses signature verification entirely, ultimately resulting in wp_set_auth_cookie() being called for the targeted account — granting admin-level access. The vulnerabilities were discovered by DigitalOcean's security team after observing an anomalous WordPress administrator session attempt from outside their trusted network. Active exploitation has been observed, described as opportunistic scanning targeting all sites with the plugin installed regardless of edition or version. A proof-of-concept (PoC) exploit exists that chains both flaws to obtain admin privileges.
1. Update the miniOrange SAML 2.0 Single Sign On plugin to version 17.0.6 or later (Standard edition) immediately to patch both CVE-2026-61979 and CVE-2026-15981. 2. Review WordPress administrator accounts and audit recent authentication logs for unauthorized or anomalous login activity, especially admin sessions originating from unexpected IP addresses. 3. Block or monitor the identified scanning IP addresses (207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, 64.225.25.188) at the firewall or WAF level. 4. Restrict WordPress admin panel access to trusted network ranges where possible. 5. Monitor for crafted SAMLResponse requests with malformed signature values targeting the plugin endpoint. 6. Given the availability of a public proof-of-concept exploit, treat patching as urgent and assume active exploitation is underway.
[object Object], [object Object], [object Object], [object Object], [object Object], [object Object]
