Skip to content
Today
Sections

Security Reports disagree5 publishers 2 min read Published Updated

Two miniOrange SAML bugs under attack, and 30,000 paid installs were never told

Patchstack says attackers are chaining CVE-2026-61979 and CVE-2026-15981 to mint WordPress admin sessions. Only the free edition got an advisory; Standard needs 17.0.6.

The Watch · Security desk

Send a correction

What happened

  • Attackers are attempting to exploit two unauthenticated bypasses in the Xecurify miniOrange SAML 2.0 SSO plugin that allow login as any WordPress user, administrators included.
  • The plugin makes a WordPress site a SAML service provider, so staff sign in through Entra ID, Okta, Google Workspace or OneLogin rather than WordPress accounts.
  • The more serious flaw, CVE-2026-15981, carries a CVSS score of 9.8 and was fixed in 17.0.6 for the Standard edition.
  • Patchstack has logged exploitation attempts and scanning from six IP addresses across Europe, Africa and the United States.
  • A proof-of-concept exploit for the free edition is already public.

Why it matters

  • Who's exposed exposure The exploit's product is a valid session cookie for an existing account, so a site unpatched since July cannot clear itself by patching alone: standing admin accounts and live sessions are the...
  • What it limits constraint Paid-edition owners cannot answer whether they are patched from the WordPress dashboard, because it raises no update warning for those builds; the inventory becomes a manual, per-site job.
  • What doesn't add up contradiction SecurityWeek reports the free-edition changelog presents 5.4.5 as a bugfix, while Patchstack scores the same defect at 9.8 and CVE.org describes total signature bypass; whichever an admin read in...
  • What's now possible capability DigitalOcean's case shows a stolen admin cookie is survivable if wp-admin operations are fenced to a trusted network, a control that holds regardless of which auth plugin fails next.

The cheap half of this is CVE-2026-15981. PHP's openssl_verify() returns a tri-state integer, and miniOrange's mo_saml_validate_signature() ran a loose boolean check against it, so the -1 that means OpenSSL errored read as truthy and was treated as a successful verification [6]. An attacker submits a SAMLResponse carrying the NameID of the account they want plus a signature malformed badly enough to break OpenSSL, and the plugin calls wp_set_auth_cookie() for that account [2]. No credentials are involved and the real identity provider never sees the request.

The other half, CVE-2026-61979, is the older SAML mistake. According to BleepingComputer's account of Patchstack's analysis, the plugin accepts the signature algorithm named in the incoming response rather than enforcing the configured one, so an attacker can nominate HMAC-SHA1 and the plugin then treats the identity provider's RSA public key as the shared secret [8]. That key is published by design, which is what makes the forgery trivial [8].

The population numbers are where this gets awkward. SecurityWeek puts the free edition on more than 10,000 sites and notes that usage figures for the paid and enterprise editions are not published [24]. BleepingComputer counts 30,000 customers across the other six editions [25], roughly three times the installed base that received an advisory at all [26]. Those six were patched in July alongside the free edition and got no alert [7], and they do not share a version line: 13.0.4 for single-site Premium, 20.2.8 for the multisite bundles, 26.0.3 for Enterprise, 32.0.8 and 35.0.7 for VIP [17]. Standard is worse than a naming problem. The 8.1 was closed in 17.0.5 and the 9.8 in 17.0.6 [21][22], so a site that took the first fix and stopped is still open to the more serious one [20].

Patchstack credits DigitalOcean's security team, which found the bugs after an anomalous WordPress administrator session attempt arrived from outside its trusted network on 16 August [10][12]. The attacker already held a valid admin session cookie, obtained by chaining the two flaws through Standard edition 16.1.9 [23], and was stalled only because admin panel operations sat restricted behind that trusted network [11]. Nothing in the plugin stopped them; a network boundary in front of wp-admin did.

Patchstack's read of the scanning is that it is opportunistic, with the exploit thrown at every site carrying the plugin without checking which edition or version is behind it [5]. Running a paid tier therefore buys no obscurity. SecurityWeek says it approached the developer for comment and would update if it responded [19].

What to watch

  • Whether Xecurify issues a security advisory for the six paid editions, or answers SecurityWeek's request for comment.
  • Whether a proof-of-concept for the paid editions appears, since the current public one targets the free build.
  • Whether any install figures are published for the paid tiers, which would size the population that was never notified.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence70
Adoption30
Hype gap+15
Incentives
Not scored
Confidence68

Perspective Coverage

5 publishers
Builder
Builder 32%
Operator
Operator 56%
Investor
Investor 12%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators.

    Reported Supported Source: The Hacker News, reporting Patchstack disclosureView cited source
  2. [2]

    Unauthenticated attackers can log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error, bypassing verification and resulting in wp_set_auth_cookie() being called for the targeted account.

    Reported SupportedView cited source
  3. [3]

    Scanning activity has been recorded from six IP addresses: 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54 and 64.225.25.188.

    Reported SupportedView cited source
  4. [4]

    Patchstack's data shows exploitation attempts and opportunistic scanning underway, launched from six IP addresses across Europe, Africa and the United States.

    Reported SupportedView cited source
  5. [5]

    Patchstack said the spread suggests opportunistic scanning rather than a targeted campaign, and that whoever is running it appears to be throwing the exploit at every site with the plugin installed without checking which edition or version is behind it.

    Reported Supported Source: PatchstackView cited source
  6. [6]

    Per the CVE.org description of CVE-2026-15981, mo_saml_validate_signature() performs a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification.

    Reported Supported Source: CVE.org description quoted by The Hacker NewsView cited source
  7. [7]

    Patchstack says the two vulnerabilities were publicly disclosed and fixed in July, but the vendor's advisory covered only the free edition, leaving the six paid editions without an alert even though fixes were provided for those too.

    Reported SupportedView cited source
  8. [8]

    Because the miniOrange SAML SSO plugin accepts the signature algorithm from incoming SAML responses instead of enforcing the configured one, an attacker can use CVE-2026-61979 to select HMAC-SHA1, causing the plugin to treat the identity provider's RSA public key as the shared secret; since the public key is known, the attacker can forge a signature the plugin accepts as authentic.

    Reported Supported Source: BleepingComputer, describing Patchstack analysisView cited source
  9. [9]

    Only the free edition has an advisory mentioning the fix in version 5.4.5, and it is listed as a bugfix rather than a security patch.

    Reported Supported Source: SecurityWeekView cited source
  10. [10]

    Patchstack credited the DigitalOcean security team for reporting the issues; DigitalOcean discovered them after observing an anomalous WordPress administrator session attempt from outside their trusted network.

    Reported SupportedView cited source
  11. [11]

    Patchstack said the attacker had already used the bypass to obtain a WordPress admin session cookie, but was stalled because the admin panel operations themselves sat restricted behind the trusted network.

    Reported Supported Source: PatchstackView cited source
  12. [12]

    Patchstack reports that on August 16, DigitalOcean blocked an anomalous WordPress administrator session originating outside its trusted network.

    Reported SupportedView cited source
  13. [13]

    Patchstack warns the WordPress administrator dashboard will not show update warnings for the paid versions of the plugin, so owners must manually upgrade to a patched release.

    Reported SupportedView cited source
  14. [14]

    A proof-of-concept exploit targeting the free edition is publicly available, so the pace of attacks could increase at any time.

    Reported SupportedView cited source
  15. [15]

    In the case of the paid editions, users have not been notified and a different versioning system makes it difficult to tell whether a website is patched; users have to manually update the plugin.

    Reported SupportedView cited source
  16. [16]

    Patchstack warned that the attacker does not need to know which edition you run, but you do, which is what makes the silent-patch situation dangerous.

    Reported Supported Source: PatchstackView cited source
  17. [17]

    Versions addressing the two flaws: Free single site 5.4.5; Premium single site 13.0.4; Standard single site listed as 17.06; Premium/Enterprise/All-Inclusive multisite 20.2.8; Enterprise/All-Inclusive single site 26.0.3; VIP single site 32.0.8; VIP multisite 35.0.7.

    Reported SupportedView cited source
  18. [18]

    The miniOrange SAML SSO plugin turns a WordPress site into a SAML service provider, letting users log in through corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace or OneLogin instead of separate WordPress credentials.

    Reported SupportedView cited source
  19. [19]

    SecurityWeek says it has reached out to the developer for comment and will update its article if it responds.

    Reported SupportedView cited source
  20. [20]

    A Standard edition site updated to 17.0.5 has closed only CVE-2026-61979 (CVSS 8.1) and remains exposed to CVE-2026-15981 (CVSS 9.8), which was fixed in 17.0.6.

    Derived Supported
  21. [21]

    CVE-2026-61979 (CVSS 8.1) is an unauthenticated privilege escalation vulnerability stemming from signature algorithm confusion, fixed in version 17.0.5 for the Standard edition.

    Reported ContestedView cited source
  22. [22]

    CVE-2026-15981 (CVSS 9.8) is an authentication bypass vulnerability stemming from accepting malformed signatures as valid, fixed in version 17.0.6 for the Standard edition.

    Reported ContestedView cited source
  23. [23]

    The investigation showed attackers chained the two flaws to obtain an admin session cookie through the Standard edition plugin in version 16.1.9.

    Reported ContestedView cited source
  24. [24]

    The free edition of the plugin is installed on more than 10,000 WordPress sites, and usage statistics are not available for the several paid and enterprise versions.

    Reported ContestedView cited source
  25. [25]

    miniOrange, created by Xecurify, is a family of seven plugins, with a free version that has 10,000 downloads and 30,000 customers for the other six.

    Reported ContestedView cited source
  26. [26]

    The 30,000 customers across the six paid editions are roughly three times the 10,000 installs of the free edition, which is the only edition that received an advisory.

    Derived Contested

Sources

5 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · August 24, 2026

    Hackers target WordPress sites in miniOrange auth bypass attacks
  2. scworld.com

    1 article · August 24, 2026

    WordPress plugin vulnerabilities allow admin account takeover
  3. securityaffairs.com

    1 article · August 25, 2026

    Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable
  4. securityweek.com

    1 article · August 25, 2026

    WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
  5. thehackernews.com

    2 articles · August 25, 2026

    Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Topics and entities

Topics

Entities