WordPress Sites Attacked

Overview

Hackers are actively exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On (SSO) plugin for WordPress, tracked as CVE‑2026‑61979 and CVE‑2026‑15981. These flaws allow attackers to forge SAML responses and log in as administrators, creating a direct path to site takeover.

How the miniOrange Plugin Works

The miniOrange SAML SSO plugin, developed by Xecurify, turns WordPress into a SAML service provider, enabling login via corporate identity platforms like Microsoft Entra ID, Okta, Google Workspace, or OneLogin.

• Free edition: ~10,000 downloads.
• Paid editions: ~30,000 customers across six versions.

Vulnerability Details

• CVE‑2026‑61979:
  • Plugin accepts the signature algorithm from incoming SAML responses instead of enforcing the configured one.
  • Attackers can select HMAC‑SHA1, causing the plugin to treat the IdP’s RSA public key as a shared secret.
  • Since the public key is known, attackers can forge signatures.
• CVE‑2026‑15981:
  • Plugin treats an OpenSSL verification error (-1) as a successful result.
  • Malformed signatures pass validation, enabling forged responses.

Together, these flaws can be chained to bypass authentication entirely.

Exploitation in the Wild

• Patchstack reports exploitation attempts began mid‑August 2026.
• DigitalOcean blocked an anomalous WordPress admin session on August 16, traced to attackers chaining the two flaws against the Standard edition v16.1.9.
• Opportunistic scanning is underway from six IP addresses across Europe, Africa, and the U.S.
• A public proof‑of‑concept exploit exists for the free edition, increasing the likelihood of widespread attacks.

Fixed Versions

The vulnerabilities were patched in July 2026, but advisories initially covered only the free edition. Paid versions were silently patched, leaving many site owners unaware.

Patched releases include:

• Free, single site – 5.4.5
• Premium, single site – 13.0.4
• Standard, single site – 17.06
• Premium/Enterprise/All‑Inclusive, multisite – 20.2.8
• Enterprise/All‑Inclusive, single site – 26.0.3
• VIP, single site – 32.0.8
• VIP, multisite – 35.0.7

Defensive Guidance

Website owners should:

• Manually update plugins: Paid editions do not show update warnings in the WordPress dashboard.
• Monitor admin sessions: Watch for logins from untrusted networks.
• Block suspicious IPs: Especially those linked to opportunistic scanning.
• Audit SAML configurations: Ensure signature algorithms are enforced.
• Apply Patchstack detection rules: Use published guidance to investigate potential compromise.

Expert in the Cloud Insight

This incident highlights the risk of silent patching in paid software editions. Without visible update alerts, many organizations unknowingly remain exposed. The lesson is clear: always verify plugin versions manually and monitor for exploitation attempts. Attackers are quick to weaponize public PoCs, and WordPress sites remain prime targets for credential theft and admin takeover.