WordPress administrators using the miniOrange SAML 2.0 Single Sign On plugin are being urged to update immediately after researchers observed hackers actively attempting to exploit two critical vulnerabilities that can be combined to bypass authentication and potentially gain administrator access.
The affected plugin allows WordPress websites to use enterprise identity platforms such as Microsoft Entra ID, Okta, Google Workspace and OneLogin for Single Sign-On rather than requiring separate WordPress usernames and passwords.
That makes the vulnerabilities particularly serious because compromising the authentication layer could allow an attacker to bypass the very security system intended to protect the website.
Two Vulnerabilities Can Be Chained Together
The vulnerabilities are tracked as:
Researchers say attackers can potentially chain the two flaws to create a forged SAML response that the plugin accepts as legitimate.
SAML, or Security Assertion Markup Language, is commonly used by organisations to allow users to authenticate through a central identity provider.
Normally, a WordPress site should verify that incoming SAML responses were genuinely signed by the trusted identity provider.
The first vulnerability breaks that trust mechanism.
CVE-2026-61979 Can Allow Forged Signatures
The miniOrange plugin reportedly accepts the signature algorithm specified inside an incoming SAML response instead of strictly enforcing the algorithm configured by the website administrator.
An attacker can abuse this behaviour by selecting HMAC-SHA1.
The plugin may then incorrectly treat the identity provider's RSA public key as though it were a shared secret used for generating the signature.
The problem is obvious: a public key is designed to be publicly available.
If an attacker already knows that key, they can potentially calculate a signature that the vulnerable plugin incorrectly accepts as authentic.
This could allow a malicious SAML response to impersonate a legitimate login request.
A Second Verification Bug Makes Matters Worse
The second flaw, CVE-2026-15981, affects how the plugin handles OpenSSL signature verification.
Instead of correctly rejecting certain verification errors, the vulnerable plugin can reportedly interpret an OpenSSL result of -1 as though verification succeeded.
That means a malformed signature that should have been rejected might instead pass validation.
Individually, both issues are serious.
Used together, they can potentially allow an attacker to construct a forged authentication response and obtain access without possessing legitimate WordPress credentials.
For administrators, the worst-case scenario is an attacker gaining an authenticated session with administrative privileges.
Paid Editions May Have Been Overlooked
Security company Patchstack says the vulnerabilities were disclosed and patched in July.
However, there was an important communication problem.
According to the researchers, the vendor's public advisory primarily highlighted the free edition even though several commercial versions were also affected and received fixes.
That may have left administrators running paid editions unaware that they also needed to update.
This is especially concerning because organisations using commercial SAML products may assume their systems are more closely managed and therefore less exposed.
In reality, a security update only helps when administrators know it exists and actually install it.
Which Versions Contain the Fix?
Users should upgrade to at least the following patched versions depending on the miniOrange edition they operate:
Anything older than the relevant patched release should be treated as potentially vulnerable.
Administrators should verify the exact edition and version installed rather than assuming WordPress will automatically warn them.
Attackers Are Already Testing the Vulnerabilities
This is no longer simply a theoretical issue.
Patchstack reports that exploitation attempts and opportunistic scanning have already been detected.
On 16 August, DigitalOcean reportedly blocked an unusual WordPress administrator session originating from outside a trusted network.
Further investigation found that attackers had apparently chained the two miniOrange vulnerabilities against Standard edition version 16.1.9 and managed to obtain a WordPress administrator session cookie.
That is particularly significant because an administrator session cookie can potentially allow the attacker to access the WordPress dashboard without needing the administrator's password again.
Once inside, the attacker could potentially install plugins, modify pages, create users or introduce malicious code depending on the privileges available.
Attack Traffic Is Coming From Multiple Regions
Researchers have also identified exploitation attempts originating from several IP addresses across Europe, Africa and the United States.
That pattern suggests the vulnerability is already being incorporated into broader opportunistic scanning.
Attackers frequently automate the process of searching the internet for vulnerable WordPress installations.
They do not necessarily need to know anything about the organisation beforehand.
Once a publicly accessible site exposes a vulnerable plugin, automated tools can identify it and attempt exploitation.
This is why delays in patching widely used WordPress plugins can become dangerous very quickly.
Public Proof-of-Concept Code Raises the Risk
A proof-of-concept exploit targeting the free edition is also reportedly publicly available.
Proof-of-concept code is often created by security researchers to demonstrate that a vulnerability is real and help vendors validate patches.
Unfortunately, the same information can make exploitation easier for criminals.
An attacker no longer needs to understand the entire vulnerability from scratch.
They can study publicly available exploit code, modify it and automate attacks against large numbers of websites.
Once usable exploit code becomes public, the time between vulnerability disclosure and widespread attack attempts can shrink dramatically.
WordPress administrators therefore should not wait for evidence that their own site is being targeted.
Paid Plugin Users May Need to Update Manually
Another important problem is that administrators using paid miniOrange versions may not receive the same update notifications normally shown inside the WordPress dashboard.
Patchstack warns that commercial editions may require website owners to manually download and install the patched release.
That makes simply checking the familiar WordPress Updates page potentially insufficient.
If your organisation uses miniOrange SAML SSO, confirm the edition directly and compare the installed version against the patched release.
Administrators should also verify updates through the vendor's legitimate distribution channel rather than downloading plugin packages from third-party websites.
Why SAML Vulnerabilities Are Particularly Serious
Authentication plugins deserve extra attention because they sit directly in front of sensitive administrative systems.
A vulnerability in an ordinary visual plugin may affect how a website looks.
A vulnerability in an authentication system can determine who is allowed to become an authenticated user.
Many organisations use SAML specifically because they want stronger centralised identity management.
Employees can authenticate through corporate systems such as Entra ID or Okta, while administrators can enforce policies centrally.
But when the WordPress service provider incorrectly validates the SAML assertion, even the strongest identity provider cannot completely protect the site.
The weakness exists on the receiving end.
An attacker may therefore bypass the normal identity-provider login process by convincing WordPress that a fabricated response is legitimate.
Administrators Should Check More Than the Plugin Version
Updating the plugin should be the immediate priority, but organisations that operated a vulnerable version should also consider investigating whether exploitation already occurred.
Look for:
Security teams should also review identity-provider logs and WordPress authentication activity around the same period.
An organisation may patch the vulnerability today while overlooking the possibility that an attacker obtained access yesterday.
Patching closes the door.
It does not automatically remove someone who may already be inside.
Single Sign-On Still Provides Important Security Benefits
The incident should not be interpreted as evidence that SAML or Single Sign-On is inherently unsafe.
Centralised authentication can provide substantial security advantages.
Organisations can enforce stronger password policies, multifactor authentication, account lifecycle management and conditional access without maintaining completely separate credentials for every service.
The important point is that every component participating in the authentication process must validate information correctly.
The identity provider can behave perfectly while a vulnerable service provider introduces its own weakness.
That is why SSO plugins should be treated as security-critical software and maintained accordingly.
WordPress Remains an Attractive Target
WordPress powers an enormous number of websites, making vulnerabilities in popular plugins especially attractive to attackers.
Criminals do not need to compromise WordPress itself.
A vulnerability in any widely installed extension may provide the access they need.
Authentication plugins are particularly valuable targets because successful exploitation can potentially provide administrator privileges immediately.
Once an attacker reaches the WordPress dashboard, they may be able to transform an ordinary website compromise into something more serious, including malware distribution, credential theft, spam campaigns or persistent backdoor access.
This makes fast patching essential whenever authentication bypass vulnerabilities become public.
Final Thoughts
The active exploitation of CVE-2026-61979 and CVE-2026-15981 demonstrates how dangerous authentication vulnerabilities can become when two flaws are chained together.
By manipulating the SAML signature algorithm and taking advantage of incorrect OpenSSL verification handling, attackers may potentially forge authentication responses and gain administrator access to vulnerable WordPress installations.
The risk is even greater because public exploit code already exists and real-world attack attempts have been observed.
For website owners using miniOrange SAML SSO, the next step should be straightforward: identify exactly which edition is installed, compare it against the patched versions and update immediately where necessary.
Paid-version users should not assume WordPress will display an automatic warning.
And if the site has been running a vulnerable release, administrators should also review login activity and WordPress configuration for evidence of compromise.
When the vulnerable component controls who can log in, patching is not simply routine maintenance — it protects the front door of the entire website.
Comments 0