Hackers are actively exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The vulnerabilities allow attackers to forge SAML responses and gain administrative access to affected WordPress sites. The flaws are classified as critical severity, indicating significant risk to site integrity and data. Exploitation attempts are ongoing, making patching urgent for all affected site owners. WordPress administrators using the miniOrange SAML plugin are strongly advised to update immediately to mitigate the risk of full site compromise.
Two critical authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) exist in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. CVE-2026-61979: The plugin accepts the signature algorithm from incoming SAML responses instead of enforcing the configured one. An attacker can specify HMAC-SHA1, causing the plugin to treat the RSA public key from the identity provider (IdP) as the shared secret. Since the public key is publicly known, the attacker can forge a SAML signature that the plugin accepts as authentic. CVE-2026-15981: The plugin treats an OpenSSL verification error (-1) as a successful result, allowing malformed signatures to pass validation. These two flaws can be chained together to bypass authentication and obtain WordPress administrator sessions. Active exploitation was first observed on August 16, 2026, when DigitalOcean blocked an anomalous WordPress administrator session. Attackers chained both flaws using the Standard edition plugin version 16.1.9. A public proof-of-concept (PoC) exploit targeting the free edition is available. Opportunistic scanning and exploitation attempts have been launched from six IP addresses across Europe, Africa, and the United States. The vulnerabilities were disclosed and patched in July, but the vendor's advisory only covered the free edition, leaving many paid-edition users unaware and unpatched.
1. Immediately upgrade all editions of the miniOrange SAML 2.0 Single Sign On plugin to the patched versions: Free single site to 5.4.5, Premium single site to 13.0.4, Standard single site to 17.06, Premium/Enterprise/All-Inclusive multisite to 20.2.8, Enterprise/All-Inclusive single site to 26.0.3, VIP single site to 32.0.8, VIP multisite to 35.0.7. 2. Note that the WordPress administrator dashboard will NOT show update warnings for paid versions; manual upgrades are required. 3. Review WordPress administrator session logs for anomalous or unexpected logins, especially from unfamiliar IP addresses or geographic locations. 4. Monitor for unauthorized administrator account creation or privilege escalation. 5. Block or monitor traffic from IP addresses identified as sources of scanning and exploitation attempts (Europe, Africa, and United States-based IPs flagged by Patchstack). 6. Consider temporarily disabling the miniOrange SAML SSO plugin if immediate patching is not possible. 7. Review identity provider (IdP) configurations and SAML response handling for any signs of tampering.
Anomalous WordPress administrator sessions originating outside trusted networks, Scanning and exploitation attempts from six IP addresses across Europe, Africa, and the United States
