Hackers Are Exploiting Two miniOrange SAML Flaws to Take Over WordPress Admin Accounts

Hackers are actively targeting WordPress websites running the miniOrange SAML 2.0 Single Sign On plugin, exploiting two critical vulnerabilities that can be chained to bypass authentication and obtain administrator access.

The vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, affect multiple editions of the plugin. Security researchers have already observed exploitation attempts, including an incident in which an attacker obtained a WordPress administrator session.

The miniOrange SAML 2.0 Single Sign On plugin allows WordPress sites to use external identity providers such as Microsoft Entra ID, Okta, Google Workspace and OneLogin for authentication. Instead of maintaining separate WordPress credentials, users can sign in through their organization’s existing identity system.

That makes the plugin a particularly sensitive component. A vulnerability in its SAML verification process can undermine the authentication layer protecting the entire WordPress installation.

The first vulnerability, CVE-2026-61979, is a signature algorithm confusion flaw. The plugin allowed the signature algorithm specified in an incoming SAML response to influence how that response was verified instead of enforcing the algorithm configured by the administrator.

An attacker could abuse this behavior to select HMAC-SHA1 and cause the plugin to use the identity provider’s RSA public key as the HMAC secret. Because the public key is not secret, an attacker could create a forged SAML response with a signature that the vulnerable plugin would accept.

CVE-2026-15981 adds another weakness to the verification process. The vulnerability is related to how the plugin handled errors returned by OpenSSL’s signature verification function. Instead of treating an error as a failed verification, the vulnerable code could interpret the -1 return value as a successful result.

When chained, the two flaws allow an attacker to construct a malicious SAML response that passes the plugin’s authentication checks. The attacker can then obtain a WordPress session for a privileged user, potentially gaining full administrator control.

Patchstack disclosed the vulnerabilities and says fixes were released in July.

This is not simply a theoretical vulnerability waiting for a future exploit. Patchstack reports that DigitalOcean detected an unusual WordPress administrator session on August 16. The session originated outside the trusted network, prompting an investigation that linked the activity to exploitation of the miniOrange SAML plugin.

The affected installation was running the Standard edition, version 16.1.9.

Patchstack has also observed scanning and exploitation attempts from six IP addresses located across Europe, Africa and the United States. A proof-of-concept targeting the free edition is publicly available, potentially lowering the barrier for other attackers.

For WordPress sites exposed to the internet, this makes the issue considerably more urgent than a vulnerability that has only been demonstrated in a lab.

There is another important part of this incident that has little to do with the technical exploit itself. miniOrange distributes seven editions of the SAML plugin, each with its own version numbering. According to Patchstack, the initial public security disclosure covered the free edition even though fixes were also released for the six paid editions.

That created a visibility problem for customers using the commercial versions.

The patched releases are:

Patchstack says WordPress administrators running some paid editions would not necessarily receive the normal dashboard update warning. In other words, having an available fix did not guarantee that the administrator would know a security update was required.

That is particularly significant for the Standard edition. The vulnerable version involved in the observed attack was 16.1.9, while the patched release is 17.0.6.

The version jump also means administrators should not assume that a normal minor update will resolve the problem.

Administrators using the miniOrange SAML 2.0 Single Sign On plugin should first identify which edition and version is installed and upgrade to the corresponding patched release. They should also check administrator login and session logs for suspicious activity, especially unexpected logins from unfamiliar locations or IP addresses.

If a vulnerable installation may have already been compromised, updating the plugin alone is not enough. Administrators should investigate existing administrator accounts, authentication logs, active sessions and unexpected changes made to the site.

The WordPress.org listing for the free edition has since moved beyond the affected release, with version 5.4.7 currently listed.