Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Attackers are exploiting two unauthenticated WordPress auth bypasses (CVE-2026-61979, CVE-2026-15981, max CVSS 9.8) in miniOrange SAML SSO to gain admin sessions.
Patchstack disclosed two flaws in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin: CVE-2026-15981 (CVSS 9.8) accepts malformed signatures because mo_saml_validate_signature() loosely checks the tri-state result of openssl_verify(), and CVE-2026-61979 (CVSS 8.1) enables privilege escalation via signature algorithm confusion. Both let unauthenticated attackers sign in as any WordPress user, including administrators; fixes shipped in Standard edition versions 17.0.6 and 17.0.5. DigitalOcean observed an attacker using the bypass to obtain an admin session cookie, opportunistic scanning is underway from six IP addresses, and PoC chaining code is public.
- Flaws fixed in Standard edition 17.0.5/17.0.6; PoC chaining code available
- Scanning seen from six IP addresses, judged opportunistic not targeted
- Signature validation flaw treats OpenSSL error return (-1) as valid verification
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-15981 | The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account. NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2026-61979 | Unauthenticated privilege escalation in miniOrange SAML SSO WordPress plugin CVE-2026-61979 is an unauthenticated privilege-escalation flaw (CWE-266, incorrect assignment of privileges) in the miniOrange 'SAML SP Single Sign On' plugin for WordPress, affecting every version up to and including 5.4.3. Because it is reachable over the network with no privileges required and no user interaction (the CVSS 3.1 vector rates attack complexity as high), a remote attacker can abuse the plugin's SAML single sign-on handling to gain WordPress administrator-level privileges without valid credentials. With administrator access, an attacker can modify content, install plugins or themes, create rogue admin accounts, and use the site as a foothold. Any WordPress site running the affected versions is exposed, and reporting indicates the plugin's paid editions were also vulnerable to related flaws in the same campaign. No public proof-of-concept is known for this specific flaw and it is not in CISA KEV (EPSS ~0.3% over 30 days), but two separate CVSS 9.8 authentication-bypass flaws in the same plugin were exploited in the wild before they were even catalogued, and attackers are actively targeting miniOrange SAML flaws that grant WordPress admin access. Do: Update the SAML SP Single Sign On plugin to a version newer than 5.4.3 on every site, including any paid editions, and deactivate the plugin temporarily if immediate patching is not possible. Audit the site for unauthorized administrator accounts, unexpected user role or privilege changes, and recently modified plugins or files, since related flaws in this plugin have been actively exploited. Review web logs for requests to the plugin's SAML endpoints and rotate administrator credentials if unknown accounts had admin access. | 8.1 | <1% |
| largetens of thousands of sites (free plugin has roughly 30,000 active WordPress installs, plus unquantified paid-edition deployments) |
Full article416 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 25, 2026Vulnerability / Web Security
Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators.
The vulnerabilities, as disclosed by Patchstack, are listed below -
- CVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation vulnerability stemming from signature algorithm confusion (Fixed in version 17.0.5 for the Standard edition)
- CVE-2026-15981 (CVSS score: 9.8) - An authentication bypass vulnerability stemming from accepting malformed signatures as valid (Fixed in version 17.0.6 for the Standard edition)
"This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification," according to a description of CVE-2026-15981 on CVE.org.
"This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account."
The WordPress security company, which credited the DigitalOcean security team for reporting the issues, said an attacker can craft a SAML response with a malformed signature and send it to the plugin, causing it to treat it as valid.
The cloud infrastructure provider is said to have discovered the vulnerabilities after observing an anomalous WordPress administrator session attempt from outside their trusted network. "The attacker had already used the bypass to obtain a WordPress admin session cookie, but was stalled because the admin panel operations themselves sat restricted behind the trusted network," Patchstack said.
The scanning activity has been recorded from the following IP addresses -
- 207.211.214.41
- 79.127.224.14
- 102.91.71.83
- 162.243.116.148
- 84.201.6.54
- 64.225.25.188
"The spread suggests opportunistic scanning rather than a targeted campaign," Patchstack added. "Whoever is running this appears to be throwing the exploit at every site with the plugin installed without checking which edition or version is behind it."
WordPress site owners are advised to apply the latest fixes to stay protected, especially given the availability of a proof-of-concept (PoC) code that allows attackers to chain the flaws to obtain admin privileges and take control of susceptible sites.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html