WordPress site owners using the miniOrange SAML 2.0 Single Sign On plugin have a reason to review their update status. Security researchers have described reports of attackers trying to exploit miniOrange SAML flaws that may allow an intruder to authenticate as any existing WordPress account, even an administrator.
According to disclosures referenced by Patchstack, the issue involves unauthenticated authentication bypasses. In practice, this means an attacker may send a crafted SAML response to the plugin and force the system into treating the signature verification as successful—leading to login as a targeted user.
What are the miniOrange SAML flaws?
The problems affect the Xecurify miniOrange SAML 2.0 Single Sign On plugin. The reported weakness covers two separate CVEs that, when combined or chained with supporting steps, can result in WordPress admin access.
Both vulnerabilities are described as unauthenticated, meaning an attacker does not need valid credentials to attempt the bypass.
The key vulnerabilities and fixed versions
Patchstack listed two CVEs with severity scores. Each is tied to signature-handling or verification behavior inside the plugin.
CVE-2026-61979 (CVSS 8.1)
This issue is described as an unauthenticated privilege escalation vulnerability connected to `signature algorithm confusion`. In other words, the way signature algorithms are handled can be abused to escalate privileges.
Patchstack reports the fix is included in version 17.0.5 of the Standard edition.
CVE-2026-15981 (CVSS 9.8)
The more critical item is CVE-2026-15981, rated with a CVSS score of 9.8. It is described as an authentication bypass that stems from accepting malformed signatures as valid.
As detailed in the public CVE description referenced in the report, the plugin’s signature validation function performs a loose boolean check on a tri-state value returned by PHP’s OpenSSL verification routine. When that routine returns an error value, the plugin may interpret it as truthy and proceed as if the signature was verified.
Patchstack indicates the fix is included in version 17.0.6 of the Standard edition.
How attackers may gain WordPress admin access
Security teams say the bypass can be triggered by sending a crafted SAMLResponse to the plugin. The attacker can control key SAML fields—most notably the NameID—to select the targeted WordPress user account.
Then, the attacker provides a deliberately malformed signature value that causes OpenSSL processing to return an error. Because of the loose boolean evaluation described for CVE-2026-15981, the plugin may treat the signature verification as successful.
Once the plugin believes authentication has succeeded, it can ultimately call the function responsible for establishing an authenticated WordPress session (including an authentication cookie) for the targeted account. That is how an intruder can potentially log in as administrators.
Evidence of real-world scanning
Patchstack notes that scanning activity has been observed from multiple IP addresses. The pattern described suggests opportunistic testing rather than a single focused intrusion.
Examples of reported IP sources include: 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, and 64.225.25.188.
In addition, the report describes how the cloud infrastructure provider attributed the discovery to an anomalous administrator session attempt coming from outside their trusted network. Patchstack adds that the attacker had already obtained an admin session cookie using the bypass, but was slowed when specific admin-panel operations were still restricted by network trust rules.
Why opportunistic attempts still matter
Even if the campaign appears broad, any site still running a vulnerable version can be a potential target. Opportunistic scanning is effective because it reduces the effort required to find working systems—attackers can attempt the same crafted SAML exchange across many installations of the plugin.
What makes this particularly risky is the nature of SAML-based login: if the signature verification step is bypassed, the plugin may grant access to accounts that already exist in WordPress.
Proof-of-concept availability and chaining risk
The report warns that a proof-of-concept (PoC) exists that can chain the weaknesses to obtain admin privileges and take control of susceptible sites.
That means defenders should not treat these as theoretical issues. Instead, the safest approach is to assume attackers can automate attempts, including attempts that combine CVE-2026-61979 and CVE-2026-15981 behavior.
What WordPress administrators should do now
If you use the miniOrange SAML 2.0 Single Sign On plugin, the priority action is straightforward: install the latest security fixes from the vendor.
Based on the disclosed patches, you should verify you are beyond:
- 17.0.5 for the CVE-2026-61979 fix (Standard edition)
- 17.0.6 for the CVE-2026-15981 fix (Standard edition)
Because attackers appear to probe for vulnerable installations without checking edition and version details, don’t rely on “almost updated” as a safety measure. Confirm the exact installed version and edition.
Check for recent login anomalies
After updating, review authentication and admin-login activity. Look for:
- Unusual SSO login attempts
- Administrator session creation from unexpected networks
- Repeated SAMLResponse processing errors or spikes in SAML-related logs
While logs are not mentioned directly beyond the reported anomalous admin session, standard incident response practices can still help you detect whether exploitation already occurred.
Practical takeaway
The reported miniOrange SAML flaws show how critical signature verification is in SSO flows. When authentication logic mistakenly treats malformed or errored signature checks as valid, attackers may bypass protections and obtain privileged sessions.
Update promptly to the fixed plugin versions, validate your current deployment status, and monitor for suspicious admin login behavior—especially if SAML-based login is exposed or widely used.
By acting quickly, you reduce the likelihood that opportunistic attackers can turn crafted SAML messages into full administrative control.
Source: https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html
