Attack attempts are targeting WordPress sites that use the miniOrange SAML 2.0 Single Sign-On plugin, exploiting two critical vulnerabilities that can be chained to bypass authentication and create a login session with administrator privileges. Xecurify develops the miniOrange plugin, which connects WordPress to enterprise identity platforms such as Microsoft Entra ID, Okta, Google Workspace, and OneLogin.
The vulnerabilities are tracked as CVE-2026-61979 and CVE-2026-15981. According to information attributed to Patchstack, they were publicly disclosed and fixed in July, while exploitation attempts and opportunistic scanning began appearing from six IP addresses distributed across Europe, Africa, and the United States.
How Can Authentication Be Bypassed?
The plugin accepts the signing algorithm supplied in the SAML response instead of enforcing the preconfigured algorithm. By leveraging CVE-2026-61979, an attacker can select HMAC-SHA1, causing the plugin to treat the identity provider’s RSA public key as a shared secret. Because the public key is known, a signature accepted by the plugin as valid can be forged.
CVE-2026-15981 concerns the handling of a verification error returned by OpenSSL; the error code -1 is interpreted as a success, allowing malformed signatures to pass. Using both vulnerabilities together enables the authentication check to be bypassed and a WordPress administrator session profile to be obtained.
Versions Containing the Fixes
The patched versions cover all plugin tiers, not only the free version:
- Free, single site: 5.4.5
- Premium, single site: 13.0.4
- Standard, single site: 17.06
- Premium/Enterprise/All-Inclusive, multisite: 20.2.8
- Enterprise/All-Inclusive, single site: 26.0.3
- VIP, single site: 32.0.8
- VIP, multisite: 35.0.7
What Changes in Practice for Site Owners?
Patchstack reported that on August 16, DigitalOcean blocked an unusual WordPress administrator session originating outside its trusted network. The investigation showed that the attackers chained the two vulnerabilities to obtain an administrator session profile through Standard version 16.1.9.
The main practical issue is that the WordPress administration dashboard does not display, according to the warning, update notifications for paid versions. Therefore, waiting for an automatic alert is not enough; site owners should manually verify the plugin version and upgrade it to the appropriate version listed above. The availability of a proof-of-concept tool targeting the free version may also increase the pace of attempts, according to the source.
certi.news Analysis
The incident’s significance lies not only in the number of plugin users, but also in the fact that a flaw within the single sign-on layer can turn a trusted corporate identity into a direct entry point to the WordPress dashboard. The incident also reveals a practical effect of a disclosure gap: limiting the alert to the free version, despite fixes being available for paid versions, left some sites without a clear incentive to update. The source does not specify the number of sites actually compromised; it establishes only the existence of exploitation attempts and at least one documented case linked to an old Standard version.