Hackers Exploit miniOrange WordPress SAML SSO Vulnerabilities to Hijack Admin Accounts
Threat actors are actively exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On (SSO) plugin for WordPress. The flaws can be chained to forge SAML responses, bypass authentication, and log in to vulnerable websites as administrators.
The miniOrange SAML SSO plugin, developed by Xecurify, allows WordPress websites to authenticate users through corporate identity providers such as Microsoft Entra ID, Okta, Google Workspace, and OneLogin. This enables users to access WordPress without relying on separate WordPress usernames and passwords.
The miniOrange SAML SSO product is available in seven editions, including free, premium, enterprise, multisite, and VIP versions. The vulnerabilities affect multiple editions of the plugin, not only the free version.
The vulnerabilities are tracked as CVE-2026-61979 and CVE-2026-15981. When combined, they allow attackers to bypass SAML signature validation and authenticate to WordPress sites with administrator privileges.
CVE-2026-61979 exists because the miniOrange SAML SSO plugin accepts the signature algorithm specified in an incoming SAML response instead of enforcing the algorithm configured by the website administrator. An attacker can abuse this behavior to select HMAC-SHA1, causing the plugin to treat the identity provider’s RSA public key as a shared secret.
Because the identity provider’s public key is available to attackers, they can use it to create a forged SAML signature that the plugin incorrectly accepts as legitimate.
The second flaw, CVE-2026-15981, affects signature validation. The plugin treats OpenSSL validation errors represented by a -1 return value as successful validation results. As a result, malformed or invalid signatures may be accepted, allowing attackers to complete the authentication bypass.
According to Patchstack, the vulnerabilities were disclosed and fixed in July. However, the vendor advisory initially addressed only the free version of the plugin, even though patches were also available for six paid editions. The lack of broader disclosure may have left websites using paid versions unaware of the security risk.
The vulnerabilities were fixed in the following plugin releases:
- Free Single Site – 5.4.5
- Premium Single Site – 13.0.4
- Standard Single Site – 17.06
- Premium, Enterprise, and All-Inclusive Multisite – 20.2.8
- Enterprise and All-Inclusive Single Site – 26.0.3
- VIP Single Site – 32.0.8
- VIP Multisite – 35.0.7
Patchstack reports that DigitalOcean detected anomalous WordPress administrator sessions originating outside its trusted network on August 16.
An investigation found that an attacker had chained the two vulnerabilities to obtain administrator session cookies from a website running the Standard Edition of the plugin, version 16.1.9.
Patchstack telemetry also indicates ongoing exploitation attempts and opportunistic scanning activity from six IP addresses located in Europe, Africa, and the United States.
Proof-of-concept exploits targeting the free version of the plugin have been published, increasing the likelihood of broader attacks against unpatched WordPress websites.
Website owners should immediately check which miniOrange SAML SSO edition and version they are running and manually upgrade to the appropriate patched release. Patchstack warns that WordPress administrators may not receive update notifications for paid versions of the plugin, making manual verification especially important.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com