Two dangerous vulnerabilities have been found in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress that let attackers sign in as any user—including administrators—even without being authenticated. The flaws were disclosed by Patchstack, with help from the DigitalOcean security team. These issues affect the Standard edition of the plugin and have been patched in versions 17.0.5 and 17.0.6. ([thehackernews.com](https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html))
What the Vulnerabilities Are
The first flaw, tracked as CVE-2026-61979, is a privilege escalation bug. It arises due to confusion over which signature algorithm is used when verifying SAML responses. Attackers could exploit this to gain elevated access. This issue was addressed in version 17.0.5 of the Standard edition. ([thehackernews.com](https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html))
The second and more severe vulnerability, CVE-2026-15981, allows for an authentication bypass. Because the plugin treats malformed signatures as valid under certain conditions, attackers can submit a specially crafted SAMLResponse. If the signature triggers an OpenSSL processing error, the plugin mistakenly accepts it and skips verification altogether. The attacker then gains full access, even if targeting admin accounts. The fix for this issue was released in version 17.0.6. ([thehackernews.com](https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html))
How Attackers Have Been Using Them
Patchstack reported that DigitalOcean first noticed suspicious WordPress admin sessions originating outside trusted network ranges. Attackers leveraged the authentication bypass to obtain admin session cookies but were blocked by network restrictions—until they had enough access to carry out moderate offenses. ([thehackernews.com](https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html))
Multiple IP addresses—six known ones—have carried out scanning activity to find vulnerable sites. The activity appears random and non-targeted, indicating attackers are sweeping across sites with the plugin installed. They’re not checking plugin edition or version before attempting to exploit. ([thehackernews.com](https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html))
Affected Users & Recommended Actions
Sites running miniOrange SAML 2.0 SSO in WordPress should immediately verify their plugin version. If it’s older than 17.0.6 (Standard edition), the site remains exposed. Administrators are urged to update to 17.0.6 or later to ensure both of the flaws are patched. ([thehackernews.com](https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html))
Attackers now have proof-of-concept code that chains these vulnerabilities together, letting them gain full admin control. The availability of such code greatly increases the urgency. ([thehackernews.com](https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html))
In summary: two severe vulnerabilities in the SAML plugin for WordPress have allowed attackers to bypass authentication entirely. One stems from improper algorithm verification; the other from misinterpreting OpenSSL signature errors. Both grant elevated privileges—including admin rights. ([thehackernews.com](https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html))
This trend of exploiting identity systems like SAML underscores a wider issue: many sites assume identity tools are safe once integrated, but under-the-hood implementation mistakes can render that trust unfounded. The rapid availability of proof-of-concept code means patches must be applied now—delay increases risk dramatically.
