WordPress websites are facing a growing cyber threat as attackers attempt to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On (SSO) Plugin. The flaws, tracked as CVE-2026-61979 and CVE-2026-15981, can be chained together to forge SAML responses and potentially gain access as website administrators.
The miniOrange SAML SSO Plugin allows WordPress websites to function as SAML Service Providers. It enables users to authenticate through corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace and OneLogin instead of using separate WordPress credentials. The vulnerabilities affect this authentication process and could allow attackers to bypass security controls.
Two vulnerabilities can be chained to bypass authentication
According to cybersecurity firm Patchstack, CVE-2026-61979 allows the plugin to accept the signature algorithm specified in an incoming SAML response instead of enforcing the algorithm configured by the website administrator.
An attacker can exploit this weakness to select the HMAC-SHA1 algorithm. The plugin can then treat the RSA public key belonging to the Identity Provider as a shared secret. Since the public key may already be publicly known, an attacker can potentially generate a forged signature that the plugin accepts as legitimate.
The second vulnerability, CVE-2026-15981, further weakens the verification process. It can cause the plugin to interpret an OpenSSL verification error as a successful verification result. When the two vulnerabilities are chained, attackers can attempt to bypass authentication and obtain an administrator session.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
Exploitation attempts detected
Patchstack said the threat is not merely theoretical, with exploitation activity already observed. On August 16, DigitalOcean reportedly blocked an anomalous WordPress administrator session originating outside its trusted network.
An investigation reportedly found that attackers had chained the two vulnerabilities to obtain an administrator session cookie through the Standard Edition of the plugin, specifically version 16.1.9.
Patchstack data also indicates that exploitation attempts and opportunistic scanning have been observed from six IP addresses across Europe, Africa and the United States. A publicly available proof-of-concept (PoC) targeting the free edition could further increase the pace of exploitation.
Paid-edition users face additional risk
The vulnerabilities were publicly disclosed and fixed in July. However, Patchstack reported that the vendor’s advisory covered the free edition, while fixes were also available for the six paid editions.
The limited disclosure reportedly meant that some websites using paid editions may not have taken immediate action. Another concern is that WordPress administrator dashboards reportedly do not display update warnings for the paid versions, requiring website owners to manually check and install the appropriate security update.
Versions containing the security fixes
According to Patchstack, the following versions address the two vulnerabilities:
- Free, Single Site — 5.4.5
- Premium, Single Site — 13.0.4
- Standard, Single Site — 17.06
- Premium/Enterprise/All-Inclusive, Multisite — 20.2.8
- Enterprise/All-Inclusive, Single Site — 26.0.3
- VIP, Single Site — 32.0.8
- VIP, Multisite — 35.0.7
Website administrators using the affected plugin should immediately verify their edition and installed version and upgrade to the corresponding patched release.
Administrator access could significantly increase the damage
The most serious consequence of an authentication bypass is the possibility of obtaining an administrator-level session. Once attackers gain such access, they could attempt to modify website settings, create or alter user accounts, install malicious plugins or files, or otherwise compromise the website.
Cybersecurity experts say patching the vulnerability should be accompanied by a review of administrator activity, authentication logs, active sessions and user accounts. Suspicious sessions should be revoked and any unexpected changes to the website should be investigated.
A Researcher at Algoritha Security said authentication bypass vulnerabilities can remain a serious risk even after patches are released if affected systems are not updated promptly and existing sessions or credentials are not reviewed. Websites using SAML-based Single Sign-On should receive particular attention because a successful attack could provide access beyond a normal user account.
The ongoing exploitation attempts, public availability of a PoC and active scanning indicate that attackers are already looking for vulnerable WordPress installations. For website administrators, applying the appropriate security update and checking for signs of unauthorised access should therefore be treated as an immediate priority.
