Two serious flaws in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress are being targeted in opportunistic attacks. The vulnerabilities can let unauthenticated attackers impersonate existing users, including administrators, and gain access to protected WordPress dashboards. Site owners should check their plugin edition and update manually where necessary.
Key takeaways
- CVE-2026-61979 and CVE-2026-15981 can bypass SAML authentication.
- Attackers may log in as any existing WordPress user, including an administrator.
- Exploitation attempts have been observed from multiple internet addresses.
- Paid plugin editions may not display normal WordPress update warnings.
- A WordPress maintenance plan can help identify, patch and investigate this type of threat.
Why the vulnerabilities are serious
The miniOrange plugin connects WordPress with identity providers such as Microsoft Entra ID, Okta, Google Workspace and OneLogin. Instead of signing in with WordPress credentials, users authenticate through an organisation’s identity platform.
The first vulnerability, CVE-2026-61979, involves signature-algorithm confusion. The plugin could accept an algorithm supplied in an incoming SAML response rather than enforcing the configured algorithm. This allowed an attacker to use a publicly available identity-provider key in a way that could produce a forged response.
The second flaw, CVE-2026-15981, concerns the handling of OpenSSL errors. A verification function can return 1 for a valid signature, 0 for an invalid one, or -1 when an error occurs. The plugin’s loose Boolean check treated -1 as successful, potentially allowing a deliberately malformed signature to pass.
Attackers can take over administrator accounts
By exploiting these weaknesses, an attacker can submit a crafted SAML response containing the username or identifier of an existing account. If accepted, WordPress creates an authenticated session for that account, potentially granting access to the administrator dashboard and the ability to alter content, install code or create additional users.
Security teams have observed scanning from several hosting, VPN, cloud and mobile-network addresses. The activity appears broad rather than focused on one organisation, but publicly available proof-of-concept material could increase exploitation.
Versions and update complications
The plugin is distributed in several independently versioned editions under the same WordPress slug. This has created confusion because a fixed version for the free edition does not necessarily protect a paid installation.
Reported fixed versions include:
- Free, single site: 5.4.5
- Premium, single site: 13.0.4
- Standard, single site: 17.0.5 for CVE-2026-61979 and 17.0.6 for CVE-2026-15981
- Premium, Enterprise and All-Inclusive multisite: 20.2.8
- Enterprise and All-Inclusive single site: 26.0.3
- VIP single site: 32.0.8
- VIP multisite: 35.0.7
Because paid editions may not show dashboard update prompts, administrators should confirm the exact edition and obtain the appropriate vendor-provided release. Do not assume that a version number from the free edition applies to a premium product.
What WordPress site owners should do
Check the installed miniOrange edition and upgrade to the corresponding patched version immediately. If the update is not offered in the dashboard, use the vendor’s approved manual update process and take a backup first.
A practical response should also include:
- Reviewing administrator login and SAML authentication logs for unfamiliar sessions.
- Checking for newly created users, changed email addresses, modified plugins or unexpected content.
- Resetting administrator passwords and invalidating active sessions if compromise is suspected.
- Restricting access to the WordPress dashboard where possible.
- Keeping WordPress core, plugins and themes covered by a regular WordPress care plan.
A managed maintenance service can provide scheduled updates, vulnerability monitoring, backups and routine checks for suspicious changes—important safeguards when plugin editions and update channels are difficult to track.