Security researchers are tracking active exploitation attempts against two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The flaws can be chained together to forge SAML responses and log in as any user, including site administrators, without valid credentials.
The plugin, developed by Xecurify, turns a WordPress site into a SAML service provider so users can authenticate through corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin. The free version has around 10,000 downloads, while the six paid editions collectively serve roughly 30,000 customers.
How the chain works
CVE-2026-61979 (CVSS 8.1) stems from the plugin accepting the signature algorithm specified in an incoming SAML response rather than enforcing the algorithm configured by the administrator. An attacker can force the plugin to use HMAC-SHA1, which causes it to treat the identity provider’s public RSA key as a shared secret. Because that key is publicly known, an attacker can forge a valid-looking signature.
CVE-2026-15981 compounds the problem by causing the plugin to misinterpret an OpenSSL verification error (-1) as a successful validation result, allowing malformed signatures to slip through.
Chained together, the two bugs let an attacker bypass authentication entirely and obtain an administrator session.
Incomplete disclosure left paid users exposed
According to Patchstack, both vulnerabilities were publicly disclosed and patched in July, but the vendor’s advisory only covered the free edition. Fixes were actually shipped for all six paid editions as well, yet without a corresponding alert, leaving many site owners unaware they needed to update. Patched versions include Free 5.4.5, Premium 13.0.4, Standard 17.06, Premium/Enterprise/All-Inclusive multisite 20.2.8, Enterprise/All-Inclusive 26.0.3, VIP 32.0.8, and VIP multisite 35.0.7.
Patchstack notes that the WordPress dashboard does not surface update notifications for the paid plugin editions, meaning administrators must manually check and upgrade.
Exploitation already underway
On August 16, DigitalOcean blocked an anomalous administrator session originating outside its trusted network. Investigation revealed attackers had chained the two flaws against a Standard edition installation running version 16.1.9 to obtain an admin session cookie. Patchstack has observed scanning and exploitation attempts from six IP addresses spanning Europe, Africa, and the United States. A public proof-of-concept targeting the free edition already exists, raising the likelihood that attack volume will increase.
Administrators running any miniOrange SAML SSO edition should verify their version against the patched releases immediately and update manually if needed.