Attackers Exploit miniOrange SAML Flaws to Gain WordPress Admin Access

Threat actors are actively exploiting two critical authentication bypass vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress. The flaws, disclosed by Patchstack, allow unauthenticated attackers to log in as any WordPress user, including administrators, potentially leading to full site compromise.

The vulnerabilities are:

• CVE-2026-61979 (CVSS 8.1) – An unauthenticated privilege escalation flaw caused by signature algorithm confusion. Fixed in version 17.0.5 of the Standard edition.
• CVE-2026-15981 (CVSS 9.8) – An authentication bypass due to accepting malformed signatures as valid. Fixed in version 17.0.6.

According to Patchstack, CVE-2026-15981 arises from the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP’s openssl_verify(). An error return value of -1 is evaluated as truthy, causing a malformed signature to be treated as valid. This enables attackers to craft a SAMLResponse with an attacker-controlled NameID and a deliberately malformed signature, bypassing verification entirely and triggering wp_set_auth_cookie() for the targeted account.

The DigitalOcean security team discovered the vulnerabilities after observing an anomalous WordPress administrator session attempt from outside their trusted network. The attacker had already obtained an admin session cookie but was stalled because admin panel operations were restricted behind the trusted network.

Patchstack recorded scanning activity from multiple IP addresses, including 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, and 64.225.25.188. The spread suggests opportunistic scanning rather than a targeted campaign, with attackers attempting to exploit every site running the plugin regardless of edition or version.

Given the availability of proof-of-concept (PoC) code that chains the flaws to obtain admin privileges, WordPress site owners are strongly advised to update the miniOrange SAML plugin to the latest patched versions immediately.