Hackers Exploit Critical miniOrange SAML SSO Flaws to Hijack WordPress Admin Accounts

Two critical flaws in the miniOrange SAML 2.0 Single Sign-On plugin could allow unauthenticated attackers to log in to vulnerable WordPress sites as any existing user, including administrators.

The flaws, tracked as CVE-2026-61979 and CVE-2026-15981, carry a CVSS score of 9.8 and have been linked to attempted exploitation activity in the wild.

The vulnerabilities affect miniOrange’s SAML-based single sign-on software, which lets WordPress sites authenticate users through an external Identity Provider.

By exploiting weaknesses in the plugin’s SAML signature validation, attackers can forge an authentication response and gain access to the WordPress /wp-admin panel without legitimate credentials.

Hackers Exploit miniOrange SAML SSO Flaws

CVE-2026-61979 is a signature algorithm confusion flaw. The plugin accepted the signature algorithm specified in the incoming SAML response, allowing an attacker to switch the expected RSA-based verification to HMAC-SHA-1.

In the vulnerable code path, the plugin could treat a publicly available RSA public key as an HMAC secret. An attacker could then use that public key to sign a malicious SAML assertion that the plugin would accept as legitimate.

The second issue, CVE-2026-15981, stems from improper handling of the openssl_verify() return value. The function returns 1 for a valid signature, 0 for an invalid signature, and -1 for an internal OpenSSL error.

The plugin treated the result as a simple Boolean value. Because -1 evaluates as true in PHP, a malformed signature that triggered an OpenSSL error could be mistakenly accepted as valid.

DigitalOcean’s security team discovered and blocked suspicious WordPress administrator session activity originating outside trusted networks.

Investigators later reproduced both bypasses in miniOrange Standard edition 16.1.9. They traced the problems to the plugin’s SAML validation logic and bundled XML security library.

According to Patchstack, the incident also exposed a major visibility issue affecting WordPress administrators. miniOrange distributes seven separately versioned editions under the same miniorange-saml-20-single-sign-on plugin slug.

Public vulnerability records initially covered only the free edition, leaving the paid editions absent from public advisories and vulnerability databases. As a result, many paid installations could appear fully patched despite running vulnerable releases.

For the Standard edition, miniOrange fixed CVE-2026-61979 in version 17.0.5 and CVE-2026-15981 in version 17.0.6. However, affected 16.x installations may not receive an update notification through the WordPress dashboard.

Administrators may need to manually upload the patched plugin package to move to the corrected 17.x release line. Security teams should identify their exact miniOrange product edition and confirm that it is upgraded to the vendor’s patched release.

They should also review WordPress, web server, and identity logs for administrator sessions from unusual or untrusted IP addresses.

DigitalOcean observed scanning attempts from multiple cloud, hosting, VPN, and mobile-network addresses, suggesting opportunistic exploitation rather than a narrowly targeted campaign.

The flaws show why plugin version tracking must account for separate commercial editions, not only a shared WordPress.org listing. When vendors patch paid versions without public advisories or clear update paths, vulnerability scanners, dashboards, and administrators can all receive a false signal that systems are secure.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC