miniOrange SAML flaws exploited for WordPress admin access

Attackers are actively trying to exploit two severe unauthenticated flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. This plugin allows websites to accept logins from an external identity provider through SAML, short for Security Assertion Markup Language, a standard for exchanging authentication information between a service and an identity provider. Because the flaws require no prior login or password, an attacker can sign in as any existing WordPress user, including site administrators. Patchstack, a WordPress security company, disclosed the vulnerabilities and credited the DigitalOcean security team for reporting them.

The two issues are tracked as CVE-2026-61979 and CVE-2026-15981. CVE identifiers are unique labels for publicly known security problems, and CVSS scores measure severity on a scale from 0 to 10. The first vulnerability, CVE-2026-61979, has a CVSS score of 8.1 and is an unauthenticated privilege escalation vulnerability caused by signature algorithm confusion. It was fixed in version 17.0.5 for the Standard edition. The second vulnerability, CVE-2026-15981, has a CVSS score of 9.8, which is rated critical, and is an authentication bypass that occurs because the plugin accepts malformed signatures as valid. It was fixed in version 17.0.6 for the Standard edition.

The most severe issue, CVE-2026-15981, sits in a function called mo_saml_validate_signature(). According to the description on CVE.org, that function performs a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify() function. PHP is the programming language WordPress is built on, and openssl_verify() is a routine that checks the cryptographic signature of a message. The function can return 1 for a valid signature, 0 for an invalid signature, or -1 when an error occurs during processing. Because the plugin treats that return value loosely, the error value -1 is evaluated as true, which is mistaken for a successful signature check. This makes it possible for an unauthenticated attacker to log in as any existing WordPress user, including administrators, by sending a specially crafted SAMLResponse containing an attacker-controlled NameID, which is the identifier that says who the user is, and a deliberately malformed signature value that causes an OpenSSL processing error. As a result, the verification is skipped and the WordPress function wp_set_auth_cookie() is called for the targeted account, giving the attacker a valid administrator session.

Patchstack says the cloud infrastructure provider DigitalOcean discovered the flaws after noticing an anomalous WordPress administrator session attempt from outside its trusted network. The attacker had already used the bypass to obtain a WordPress admin session cookie, but was stalled because the admin panel operations themselves were restricted to the trusted network. Patchstack also shared the IP addresses from which the scanning activity has been recorded: 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, and 64.225.25.188. The security company said the spread suggests opportunistic scanning rather than a targeted campaign, with whoever is running it throwing the exploit at every site with the plugin installed without checking which edition or version is behind it.

WordPress site owners who use the plugin should update to the latest fixed version immediately, especially because proof-of-concept code is already available that chains the two flaws together to obtain admin privileges and take control of susceptible sites. The fixes are in version 17.0.6 for the Standard edition, and users should check their WordPress dashboard for available updates. Because attackers do not need to know a password and the exploit can be launched over the internet, any site with the vulnerable plugin is a potential target until patched. Patchstack's finding that the scanning appears opportunistic means many site owners may already be being probed, even if their specific edition or configuration was not deliberately chosen.

Once an attacker obtains administrator access, they can take control of the site, change content, install malicious code, or lock out the legitimate owner. This makes the flaw especially serious for businesses that rely on WordPress for customer-facing pages or internal tools. For website owners who would rather have WordPress maintenance handled by a provider, AEU Hosting offers managed WordPress hosting secured end to end. Site owners can also review administrator accounts and access logs for suspicious login activity from the IP addresses listed above and enable two-factor authentication as an extra layer of protection.