Cybersecurity researchers have discovered a pair of critical vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing hackers to forge SAML responses and log in as administrators without needing valid credentials. This exploit has been observed in exploitation attempts targeting several thousand websites running the affected plugins.
The miniOrange SAML SSO plugin is designed to integrate corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin with WordPress sites, allowing users to access these platforms through their existing work credentials rather than separate WordPress login information. However, this convenience comes at a cost: the plugin’s authentication mechanism can be bypassed by exploiting two critical vulnerabilities tracked as CVE-2026-61979 and CVE-2026-15981.
The first vulnerability allows attackers to select an insecure signature algorithm from incoming SAML responses, causing the plugin to treat the RSA public key from the identity provider (IdP) as the shared secret. Since the public key is publicly known, attackers can forge a signature that the plugin accepts as authentic. The second security issue causes the plugin to accept malformed signatures despite OpenSSL verification errors.
These two vulnerabilities were publicly disclosed and fixed in July by the vendor, but only for the free edition of the plugin. This meant that many sites running paid editions took no action to update their plugins, creating an opportunity for threat actors to exploit the two vulnerabilities. According to security firm Patchstack, attackers have already chained these flaws together to obtain an admin session cookie through the Standard edition plugin in version 16.1.9.
Patchstack’s investigation showed that exploitation attempts and opportunistic scanning are underway, launched from six IP addresses across Europe, Africa, and the United States. A proof-of-concept (PoC) exploit targeting the free edition is also publicly available, so the pace of attacks could increase at any time. What’s more alarming is that once attackers have valid credentials, only 37% of their actions are blocked by security measures.
To mitigate this risk, website owners must manually upgrade to a patched release, as update warnings will not be shown in the WordPress administrator dashboard for paid versions of the plugin. It’s essential for site administrators to stay vigilant and regularly check for updates to ensure that their plugins are up-to-date and secure.
In light of this exploit, it’s crucial to remember that even with robust security measures in place, attackers can still gain access once they have valid credentials. As such, website owners should prioritize updating their plugins and maintaining a strict password policy to prevent unauthorized access.
Source: Bleeping Computer — 2026-08-24