miniOrange SAML Plugin Vulnerabilities Allow WordPress Admin Takeover

Attackers are actively exploiting two authentication bypass flaws in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress. This plugin lets site visitors use one set of credentials from an external identity provider to log in, a feature known as Single Sign On (SSO). The vulnerabilities can allow someone who is not logged in to sign in as any existing WordPress user, including administrators. Security company Patchstack disclosed the issues and credited the DigitalOcean security team with reporting them.

The first flaw, tracked as CVE-2026-61979, has a CVSS severity score of 8.1. It is an unauthenticated privilege escalation problem caused by confusion in the way the plugin checks digital signatures. The fix was released in version 17.0.5 for the Standard edition. The second flaw, tracked as CVE-2026-15981, is rated 9.8 on the CVSS scale, making it critical. It stems from the plugin accepting malformed signatures as valid. The fix for this second issue appeared in version 17.0.6 for the Standard edition.

The more severe flaw, CVE-2026-15981, works because a function inside the plugin called mo_saml_validate_signature() performs a loose boolean check on the raw result of PHP's openssl_verify() function. That underlying function normally returns 1 when a signature is valid, 0 when it is not, and -1 when an error happens during processing. The plugin's check treats the error value -1 as if it meant true, so a failed verification is mistakenly accepted as a success. As a result, an attacker can send a specially crafted SAMLResponse containing a NameID they control and a deliberately malformed signature that triggers an OpenSSL error. The plugin then calls wp_set_auth_cookie() for the targeted account, which logs the attacker in as that user without needing a password.

Patchstack explained that an attacker can craft a SAML response with a malformed signature and send it to the plugin, causing the plugin to treat it as valid. The WordPress security company said the DigitalOcean team discovered the vulnerabilities after noticing an anomalous WordPress administrator session attempt coming from outside the cloud provider's trusted network. The attacker had already used the bypass to obtain an admin session cookie, but was stalled because the admin panel operations were restricted behind that trusted network.

Scanning activity has been recorded from six IP addresses: 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, and 64.225.25.188. Patchstack said the spread suggests opportunistic scanning rather than a targeted campaign, and that whoever is running it appears to be throwing the exploit at every site with the plugin installed without checking which edition or version is present. A public proof of concept is also available, and attackers can chain the two flaws to obtain admin privileges and take control of susceptible sites.

WordPress site owners who use this plugin should update to the latest version, ideally 17.0.6 or later, as soon as possible. Because the flaws allow full admin access, a successful exploit can lead to the attacker installing malware, creating hidden admin accounts, or defacing the site. For website owners who would rather have this maintenance handled for them, managed WordPress hosting services such as AEU Hosting can help keep WordPress and its plugins updated and monitored, reducing the window in which a vulnerable plugin remains exposed.