WordPress Security Breach: Hackers Exploit Critical miniOrange SAML Vulnerability

Post Views: 8

Cybersecurity researchers have identified active exploitation of two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On (SSO) Plugin, a widely used tool for integrating WordPress sites with corporate identity platforms.

Vulnerabilities in miniOrange SAML Plugin

The flaws, designated CVE-2026-61979 and CVE-2026-15981, enable attackers to manipulate SAML authentication processes and potentially escalate privileges to administrator-level access. The vulnerabilities are linked to the plugin’s handling of SAML responses, which are used to verify user identities during login.

CVE-2026-61979

CVE-2026-61979 allows the plugin to accept a signature algorithm specified in an incoming SAML response rather than enforcing the algorithm configured by the site administrator. This creates an opportunity for adversaries to exploit the HMAC-SHA1 algorithm, treating the Identity Provider’s RSA public key as a shared secret. Since public keys are often accessible to attackers, this flaw could enable the creation of forged signatures that the plugin validates as legitimate.

CVE-2026-15981

CVE-2026-15981 further weakens the authentication mechanism by misinterpreting OpenSSL verification errors as successful validations. When combined, these issues allow threat actors to bypass authentication controls and obtain administrator session cookies.

Exploitation and Detection

Security firm Patchstack reported that exploitation attempts have already been observed, with one incident involving a compromised WordPress administrator session traced to an unauthorized source. DigitalOcean detected the anomaly on August 16, and subsequent analysis confirmed the use of the two vulnerabilities to exploit the free edition of the plugin, specifically version 16.1.9. Additional scanning activity from six IP addresses across Europe, Africa, and the United States has also been documented.

A publicly available proof-of-concept (PoC) targeting the free version may accelerate further attacks.

Patched Versions and Recommendations

The vendor addressed the vulnerabilities in July, releasing patched versions for the free edition and six paid variants. However, Patchstack noted that some paid edition users may remain at risk due to limited disclosure of the advisory. Website administrators using paid versions must manually verify and apply updates, as the WordPress dashboard does not display alerts for these editions.

Free, Single Site: 5.4.5
Premium, Single Site: 13.0.4
Standard, Single Site: 17.06
Premium/Enterprise/All-Inclusive, Multisite: 20.2.8
Enterprise/All-Inclusive, Single Site: 26.0.3
VIP, Single Site: 32.0.8
VIP, Multisite: 35.0.7

Administrators are urged to confirm their plugin edition and installed version, then upgrade to the corresponding patched release. Unauthorized access to administrator accounts could lead to severe consequences, including modification of website settings, creation of malicious user accounts, installation of harmful plugins, or data exfiltration.

Conclusion and Urgent Actions

Cybersecurity experts emphasize that even after patches are applied, systems remain vulnerable if outdated sessions or credentials are not reviewed. SAML-based SSO implementations require heightened scrutiny, as a successful breach could grant attackers access beyond standard user privileges. The combination of active exploitation, public PoC availability, and ongoing scanning underscores the urgency of remediation. Website owners must prioritize applying security updates and monitoring for signs of unauthorized activity, such as suspicious sessions or unexpected changes to configurations.