Cybercriminals are targeting two critical auth‑bypass vulnerabilities in the miniOrange SAML 2.0 SSO plugin for WordPress, enabling forged SAML responses and admin logins. The vendor warned only the free edition, leaving many paid users exposed.
- Two CVE‑2026‑61979 and CVE‑2026‑15981 bypass flaws discovered in miniOrange SAML SSO
- Free version patched; six paid editions received no public advisory
- Exploit attempts traced to IPs across Europe, Africa and the United States
How the Plugin Works and Why It Matters
miniOrange SAML SSO turns a WordPress site into a SAML service provider, letting users authenticate via corporate IdPs such as Microsoft Entra ID, Okta, Google Workspace or OneLogin. Developed by Xecurify, the suite includes seven plugins, with the free version counting over 10,000 downloads and a total customer base of 30,000 across all editions.
The Two Critical Vulnerabilities
The first flaw, CVE‑2026‑61979, allows the plugin to accept the signature algorithm supplied in the incoming SAML response. An attacker can force HMAC‑SHA1, causing the RSA public key from the IdP to be treated as a shared secret. With the public key publicly known, the attacker can forge a signature that the plugin accepts as genuine.
The second flaw, CVE‑2026‑15981, misinterprets an OpenSSL verification error (-1) as a successful verification, letting malformed signatures pass validation. Chaining both bugs grants a complete authentication bypass.
Patching Status and Affected Versions
According to security firm Patchstack, both vulnerabilities were disclosed and fixed in July, but the vendor’s advisory covered only the free edition. The following versions contain the necessary patches:
| Edition | Patched Version |
|---|---|
| Free, single site | 5.4.5 |
| Premium, single site | 13.0.4 |
| Standard, single site | 17.06 |
| Premium/Enterprise/All‑Inclusive, multisite | 20.2.8 |
| Enterprise/All‑Inclusive, single site | 26.0.3 |
| VIP, single site | 32.0.8 |
| VIP, multisite | 35.0.7 |
Why This Matters
BozokMedia analysis shows that the incomplete disclosure left countless paid‑edition sites unpatched, providing threat actors a window to chain the two bugs and steal admin session cookies. The impact extends beyond credential theft to potential full‑site compromise.
"Dual‑stage SAML bypasses are rare, but when they appear together they become a weapon of mass compromise," notes cybersecurity analyst Ajay Singh.
Frequently Asked Questions
Q1: Is updating only the free edition sufficient?
A: No. All premium, standard, and enterprise editions must be upgraded to the patched releases (e.g., 20.2.8 or later).
Q2: How can I verify if my site is vulnerable?
A: Use Patchstack’s scanner or run a WP‑CLI command to check the installed plugin version, then update immediately if it’s below the patched baseline.
