Attackers are actively probing WordPress sites for two critical, unauthenticated vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin that let an attacker log in as any user, including an administrator, without a password. The flaws, tracked as CVE-2026-61979 and CVE-2026-15981, affect all seven editions of the plugin. Patches have been available since around August 21, and DigitalOcean’s security team says it caught real exploitation attempts starting August 16, scanning from at least six IP addresses across Europe, Africa, and the US.
What’s Actually Broken in the miniOrange SAML Plugin
Both bugs live in how the plugin verifies the digital signature on an incoming SAML response, which is the part of SSO that’s supposed to prove the login request really came from your identity provider.
CVE-2026-15981 is the messier of the two. The plugin’s signature check calls PHP’s openssl_verify(), which can return 1 (valid), 0 (invalid), or -1 (an error occurred). The plugin treats that return value as a plain boolean, and in PHP, -1 evaluates as true. So a deliberately malformed signature that makes OpenSSL throw an error gets waved through as a valid one. CVE-2026-61979 works differently: the plugin lets the incoming SAML response pick its own signature algorithm instead of enforcing the one configured for the site. An attacker can request HMAC-SHA1 and then sign the forged response using the identity provider’s public key as if it were a shared secret, since that key is, by definition, publicly available.
Either bug on its own is enough to forge a login as any existing user. Patchstack’s technical writeup has the full breakdown of both signature-verification paths if you want the code-level detail.
Who’s Affected and What’s Patched
This covers all seven editions sold under the miniOrange SAML SSO product line. The free plugin alone has around 10,000 active installs, and miniOrange puts total customers across the paid editions at roughly 30,000.
- Free: patched in 5.4.5
- Premium (single site): patched in 13.0.4
- Standard (single site): patched in 17.0.6
- Premium/Enterprise/All-Inclusive (multisite): patched in 20.2.8
- Enterprise/All-Inclusive: patched in 26.0.3
- VIP (single site): patched in 32.0.8
- VIP (multisite): patched in 35.0.7
A public proof of concept exists for the free edition, and BleepingComputer reports the scanning activity DigitalOcean flagged looked opportunistic rather than targeted, meaning attackers appear to be sweeping any site running the plugin rather than going after specific targets. That’s actually the more urgent case for most site owners: opportunistic scanners don’t wait for a slow patch cycle.
What to Do If You’re Running This Plugin
Check your installed edition and version against the table above and update immediately if you’re below the patched release. If your site uses SAML SSO for client portals, staff logins, or an intranet area, an admin account takeover here means full control of the site, not just one user’s account, so this isn’t one to queue up for the next maintenance window.
If you don’t recognize whether your site runs this plugin, it’s worth a quick audit rather than assuming. This is exactly the kind of gap a WordPress security review catches before it becomes an incident. ConicPlex’s WordPress development team handles plugin audits like this as part of ongoing site maintenance, alongside the update itself.
It’s also worth revisiting how the last few weeks have gone for WordPress admin-access bugs specifically. This is at least the second unauthenticated admin-takeover class vulnerability disclosed this month; ConicPlex covered a similar admin takeover bug in the User Profile Builder plugin two weeks ago. If your site runs several third-party plugins that touch authentication, that pattern alone is a reason to check update status across all of them, not just the one making headlines this week.
Sources
- CVE-2026-15981 – NVD
- CVE-2026-61979 – NVD
- Patchstack: “One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin”
- BleepingComputer: “Hackers target WordPress sites in miniOrange auth bypass attacks”
- The Hacker News: “Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access”
