Two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin could allow unauthenticated attackers to forge SAML assertions and access /wp-admin as any existing account, including administrators.
The flaws, tracked as CVE-2026-61979 and CVE-2026-15981, carry a CVSS score of 9.8 and have reportedly been targeted by opportunistic scanning activity.
DigitalOcean’s security team detected and blocked an anomalous WordPress administrator session attempt on its infrastructure, and then reproduced both bypasses in miniOrange’s Standard edition, version 16.1.9.
Critical WordPress SAML SSO Flaws
Patchstack coordinated vendor follow-up and expanded its vulnerability database coverage after discovering that the plugin’s distribution model obscured exposure across paid editions.
CVE-2026-61979 stems from signature-algorithm confusion. The plugin allowed an incoming SAML response to select HMAC-SHA1 as its signature method, then treated a trusted RSA public-key PEM as the HMAC secret.
Because an IdP public key is publicly available, an attacker could generate a forged assertion that the vulnerable plugin would accept as legitimate. miniOrange fixed this issue in Standard edition version 17.0.5.
CVE-2026-15981 involves improper handling of openssl_verify() return values. The function returns 1 for a valid signature, 0 for an invalid signature, and -1 on an OpenSSL error.
Because the plugin used a loose Boolean check, PHP interpreted -1 as truthy, potentially allowing malformed signatures that trigger an OpenSSL error to pass verification. Standard edition version 17.0.6 addresses this flaw.
The key exposure issue is that miniOrange distributes seven independently versioned editions under the single WordPress slug, miniorange-saml-20-single-sign-on. Public advisories initially covered only the freely downloadable edition, patched in version 5.4.5.
Paid editions used entirely different version ranges, including 13.x, 16.x, 20.x, 26.x, 32.x, and 35.x, causing conventional vulnerability databases and scanners to mistakenly identify vulnerable installations as already patched.
A Standard deployment running version 16.1.9, for example, could appear unaffected when compared only with the free-edition fixed release number.
Administrators should not rely solely on the WordPress dashboard. Patchstack reported that vulnerable Standard 16.x installations may not receive an automated update prompt for the patched 17.x release, instead requiring a manual plugin upload.
Organizations should identify their exact miniOrange edition, upgrade to the vendor-provided patched version, review administrator authentication logs, and investigate unexpected sessions, especially those originating outside trusted network ranges.
DigitalOcean observed scanning from several VPN, hosting, cloud, and mobile-network IP addresses, suggesting broad, opportunistic exploitation attempts rather than a narrowly targeted campaign.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
