Attackers Exploit miniOrange SAML Flaws to Seize WordPress Admin

Attackers are actively trying to exploit two serious authentication bypass vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress, according to an advisory from Patchstack, a WordPress security company. SAML stands for Security Assertion Markup Language, a standard that lets a user log in once and then access several services without signing in again. The plugin adds this single sign-on ability to WordPress sites. The flaws make it possible for an unauthenticated person to log in as any existing WordPress user, including a site administrator, which means a successful exploit can hand over full control of a website to an outside attacker without needing a password.

Patchstack identifies the two vulnerabilities as CVE-2026-61979 and CVE-2026-15981. CVE-2026-61979 has a Common Vulnerability Scoring System (CVSS) severity score of 8.1 and is described as an unauthenticated privilege escalation problem. Privilege escalation means gaining a higher level of access than you should have, and in this case it comes from confusion in how the plugin checks the algorithm used for a digital signature. That flaw is fixed in version 17.0.5 of the Standard edition. CVE-2026-15981 has a higher CVSS score of 9.8 and is an authentication bypass that happens because the plugin accepts malformed signatures as valid. Authentication bypass means an attacker can skip the normal login check. This second flaw is fixed in version 17.0.6 of the Standard edition.

The technical root of CVE-2026-15981 is explained on CVE.org, a public database of security vulnerabilities. The plugin's mo_saml_validate_signature() function performs a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(). In plain language, when the verification process returns the value -1, meaning an error occurred, the loose check treats that -1 as true and therefore as a successful signature check. An attacker can submit a crafted SAMLResponse that contains an attacker-controlled NameID, which is the identifier a service uses to know who is logging in, and a deliberately malformed signature value that triggers an OpenSSL processing error. The verification is bypassed entirely, and the plugin then calls wp_set_auth_cookie() for the targeted account. That function creates the login cookie for WordPress, so the attacker is effectively logged in as that user.

Patchstack credits the DigitalOcean security team with discovering the vulnerabilities after they observed an anomalous WordPress administrator session attempt from outside a trusted network. The attacker had already used the bypass to obtain a WordPress admin session cookie, but could not complete further admin panel actions because those operations were restricted to the trusted network. The scanning activity has been recorded from six IP addresses: 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, and 64.225.25.188.

Patchstack adds that the spread suggests opportunistic scanning rather than a targeted campaign. The activity appears to throw the exploit at every site where the plugin is installed without checking which edition or version is behind it. WordPress site owners should apply the latest fixes right away. The urgency is increased by the availability of proof-of-concept code, often shortened to PoC, which is sample code that demonstrates how an attack works. Attackers can chain the two flaws together to obtain admin privileges and take control of vulnerable sites.

For site owners who are still running the miniOrange SAML plugin, the immediate action is to update to version 17.0.6 or the latest release, and to check whether the plugin is actually still needed. Removing unused plugins reduces the attack surface. For organizations that prefer this kind of patching to be handled as part of their hosting platform, AEU Hosting offers managed WordPress hosting with end-to-end security, which can help keep a WordPress installation maintained with less manual effort.