Cybersecurity experts are sounding the alarm about a critical vulnerability affecting thousands of WordPress websites. Hackers have been exploiting two authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin, which allows users to log into their sites using corporate identity platforms rather than separate WordPress credentials.
The miniOrange SAML SSO plugin is used by over 30,000 customers and has been downloaded more than 10,000 times for its free version alone. The plugin’s purpose is to turn a WordPress site into a SAML service provider, allowing users to access their sites through platforms like Microsoft Entra ID, Okta, Google Workspace, or OneLogin.
The two critical vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, can be chained together to bypass authentication. The first issue allows attackers to select a weak signature algorithm, HMAC-SHA1, which is easily forgeable since the RSA public key from the identity provider (IdP) is known. This enables hackers to create a fake signature that the plugin will accept as authentic.
The second vulnerability causes the plugin to treat an OpenSSL verification error (-1) as a successful result, allowing attackers to submit malformed signatures for validation. This makes it possible for hackers to gain administrative access to vulnerable sites.
Patchstack, a security firm, reported that the two vulnerabilities were publicly disclosed and fixed in July, but only for the free edition of the plugin. The vendor’s advisory did not alert users about the paid editions, which also needed updates. As a result, many websites running the paid versions took no action, leaving them vulnerable to exploitation.
On August 16, DigitalOcean blocked an anomalous WordPress administrator session originating outside its trusted network. An investigation revealed that attackers had chained the two vulnerabilities to obtain an admin session cookie through the Standard edition plugin in version 16.1.9. Patchstack’s data indicates that exploitation attempts and opportunistic scanning are underway from six IP addresses across Europe, Africa, and the United States.
A proof-of-concept (PoC) exploit targeting the free edition is also publicly available, which may lead to an increase in attacks. To protect their sites, website owners must manually upgrade to a patched release since the WordPress administrator dashboard will not show update warnings for paid versions of the plugin.
This incident serves as a reminder that cybersecurity is an ongoing process and vigilance is crucial. As the Blue Report 2026 highlights, once attackers gain valid credentials, only 37% of their actions are blocked. This underscores the importance of staying informed about vulnerabilities and promptly addressing them to prevent exploitation.
Source: Bleeping Computer — 2026-08-24