Critical miniOrange SAML SSO Flaws Let Attackers Hijack WordPress Admin Accounts

Key Takeaways

• Two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress enable unauthenticated attackers to hijack administrator accounts.
• Tracked as CVE-2026-61979 and CVE-2026-15981, both flaws carry a CVSS score of 9.8 and have been observed in active exploitation attempts.
• The vulnerabilities affect various miniOrange SAML SSO editions, with patching complexities due to separate versioning and update paths for paid versions.
• Administrators must manually verify and update their miniOrange SAML SSO plugin to a patched version, as automatic updates may not be triggered for all editions.

Two severe security vulnerabilities discovered in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress could allow unauthorized individuals to log in as any existing user, including administrators, on compromised sites. These flaws, identified as CVE-2026-619979 and CVE-2026-15981, both have a critical CVSS score of 9.8 and have been linked to observed exploitation attempts in the wild.

The miniOrange SAML-based single sign-on solution facilitates user authentication on WordPress sites via external Identity Providers. The vulnerabilities exploit weaknesses in the plugin’s SAML signature validation process, enabling attackers to craft a fraudulent authentication response. This manipulated response grants them unauthorized access to the WordPress /wp-admin panel without requiring legitimate user credentials.

Technical Deep Dive into the Flaws

The first vulnerability, CVE-2026-61979, is a signature algorithm confusion issue. The plugin was found to accept the signature algorithm specified within an incoming SAML response. This design flaw allowed an attacker to alter the expected RSA-based verification mechanism to HMAC-SHA-1. In a specific vulnerable code path, the plugin incorrectly interpreted a publicly available RSA public key as an HMAC secret. An attacker could then leverage this public key to sign a malicious SAML assertion, which the plugin would subsequently accept as valid.

The second vulnerability, CVE-2026-15981, stems from improper handling of the openssl_verify() function’s return value. This function typically returns 1 for a valid signature, 0 for an invalid signature, and -1 if an internal OpenSSL error occurs. However, the plugin treated this return value as a simple Boolean. Crucially, in PHP, a value of -1 evaluates to true. Consequently, a malformed signature that triggered an OpenSSL error could be erroneously accepted as legitimate by the plugin.

Discovery and Exploitation

The security team at DigitalOcean initially detected and blocked suspicious WordPress administrator session activity that originated from outside their trusted networks. Their subsequent investigation successfully reproduced both bypass techniques in miniOrange Standard edition 16.1.9. The root cause of these issues was traced back to the plugin’s SAML validation logic and its bundled XML security library.

According to Patchstack, the incident also exposed a significant visibility problem for WordPress administrators. miniOrange distributes seven distinct, separately versioned editions of its plugin under the same miniorange-saml-20-single-sign-on plugin slug. Initially, public vulnerability records only covered the free edition, leaving the paid editions unmentioned in public advisories and vulnerability databases. This oversight led many administrators of paid installations to believe their systems were fully patched, even when they were running vulnerable releases.

Patching and Mitigation Challenges

For the Standard edition, miniOrange addressed CVE-2026-61979 in version 17.0.5 and CVE-2026-15981 in version 17.0.6. However, existing 16.x installations may not receive automatic update notifications through the WordPress dashboard. Administrators might need to manually upload the patched plugin package to transition to the corrected 17.x release line. DigitalOcean’s observations indicated scanning attempts from various cloud providers, hosting services, VPNs, and mobile network addresses, suggesting opportunistic exploitation rather than a highly targeted campaign.

These flaws highlight a critical challenge in plugin version tracking, particularly when vendors manage separate commercial editions alongside a shared WordPress.org listing. When patches for paid versions are released without clear public advisories or straightforward update paths, vulnerability scanners, dashboards, and administrators can all receive misleading signals that their systems are secure when, in fact, they remain vulnerable.

What You Should Do

• Identify your exact miniOrange SAML 2.0 Single Sign-On plugin edition.
• Verify that your plugin is updated to the patched versions: Standard edition 17.0.5 (for CVE-2026-61979) and 17.0.6 (for CVE-2026-15981), or later.
• If running an affected 16.x installation, be prepared to manually upload the patched 17.x plugin package, as automatic updates may not be available.
• Review WordPress, web server, and identity provider logs for any administrator sessions originating from unusual or untrusted IP addresses.
• Implement strong access controls and multi-factor authentication (MFA) for all WordPress administrator accounts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.