Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access, Prompting Urgent Patch Warnings
Security researchers say hackers are actively exploiting two critical authentication bypass flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, a combination that lets attackers forge login credentials and walk straight into a site with full administrator control. The vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, were publicly disclosed and patched back in July, but exploitation attempts picked up only recently, exposing a gap between when a fix becomes available and when site owners actually apply it.
The miniOrange SAML SSO plugin is built to turn a WordPress site into a SAML service provider, letting employees or members log in using corporate identity systems like Microsoft Entra ID, Okta, Google Workspace or OneLogin instead of maintaining separate WordPress usernames and passwords. It is one of seven plugins in the broader miniOrange family maintained by developer Xecurify, with the free edition alone reporting around 10,000 active installs and the six paid editions serving roughly 30,000 additional customers. That footprint, concentrated heavily in organizations that specifically wanted enterprise style single sign on for their WordPress environment, makes the current wave of attacks particularly concerning, since compromised sites in this category often sit closer to sensitive internal systems than a typical hobbyist blog.
The mechanics of the attack rely on chaining the two flaws together. CVE-2026-61979 stems from the plugin trusting the signature algorithm specified inside an incoming SAML response instead of enforcing whatever algorithm the site administrator actually configured for their identity provider. That design flaw lets an attacker force the plugin to use HMAC-SHA1 and then treat the identity provider’s public RSA key as if it were a shared secret, which is enough to forge a signature that looks legitimate. CVE-2026-15981 compounds the problem by allowing those forged, malformed signatures to pass the plugin’s validation checks entirely. Put together, the two bugs let an unauthenticated attacker manufacture a fake SAML assertion, present it to the plugin, and receive back a valid administrator session cookie, all without ever knowing a real password.
Patchstack, the security firm that has been tracking exploitation of the flaws, reported that DigitalOcean flagged an anomalous WordPress administrator session originating from outside its trusted network on August 16. Investigation of that incident showed attackers had successfully chained the two vulnerabilities against a site running the plugin’s Standard edition to obtain a valid admin session cookie, confirming that the theoretical attack path researchers described in July was already being used in the wild. That timeline, roughly five weeks between public disclosure of a patch and confirmed real world exploitation, is a fairly typical window for opportunistic attackers scanning the internet for WordPress sites still running vulnerable plugin versions.
What has made this particular situation worse is how the original disclosure was communicated. According to Patchstack, miniOrange’s own security advisory only covered the free version of the plugin, even though the company had quietly shipped fixes for all six paid editions at the same time. Site owners running any of the paid tiers had no visibility into the fact that they were affected, since WordPress’s standard update notification system does not flag issues for commercially licensed plugin variants the way it does for free plugins listed on WordPress.org. That gap in disclosure appears to have left a meaningful number of paying customers unaware they needed to act, effectively extending the vulnerability window for exactly the customers who might have assumed that paying for a product meant better security communication, not less.
This is not the first serious security problem to hit the miniOrange plugin family this year. In July, Patchstack separately disclosed CVE-2026-57807, a maximum severity flaw rated 9.8 on the CVSS scale affecting miniOrange’s OAuth Single Sign On plugin, the tool many sites use to power Login with Google or Login with Microsoft buttons. That bug, found in the plugin’s password recovery flow, let unauthenticated attackers authenticate as any user, including administrators, with no vendor patch initially available. The recurrence of critical authentication bypass bugs across multiple products from the same vendor in a short span of months suggests a pattern worth watching for anyone relying on miniOrange’s broader SSO ecosystem, rather than an isolated one-off mistake.
For site administrators, the practical response to the SAML vulnerability is straightforward even if the underlying flaw is technically involved. Anyone running the miniOrange SAML 2.0 Single Sign On plugin, in any edition, should confirm exactly which version is installed and upgrade immediately to the patched release, since the free and paid editions were fixed separately and require separate confirmation. Because the exploit grants a valid admin session without necessarily triggering standard failed login alerts, a security audit after patching is worth doing rather than assuming the absence of obvious warning signs means a site was never touched. That audit should include checking the list of administrator accounts for anything unrecognized, reviewing recently modified files, and looking for unexpected scheduled tasks or outbound connections to unfamiliar domains, all common indicators left behind once an attacker has gained privileged access to a WordPress installation.
The broader lesson extends past this single plugin. WordPress powers a significant share of the web, and its plugin ecosystem, while enormously useful, remains one of the most consistent sources of critical vulnerabilities across the platform. Authentication and SSO plugins carry outsized risk precisely because their entire purpose is deciding who gets treated as a trusted user, so a flaw in that logic tends to produce the worst possible outcome, complete administrative control, rather than a narrower data leak. Site owners who have delegated login security to a third party plugin would do well to treat vendor security advisories as seriously as they would a warning from their hosting provider, and to check that paid product tiers are receiving the same visibility into patches that free versions get by default.
For readers tracking WordPress security vulnerabilities more broadly, this incident is a reminder that patch availability and patch adoption are two very different things, and attackers are consistently faster at finding the gap between them than most site owners are at closing it. Technical details and remediation guidance on the specific CVEs involved are available directly from Patchstack, while affected users can check plugin version details and update paths through the WordPress plugin directory.
