miniOrange SAML Flaws Exploited to Hijack WordPress Admin Accounts

Attackers are actively scanning for WordPress sites running vulnerable versions of the Xecurify miniOrange SAML 2.0 Single Sign-On plugin, exploiting two unauthenticated authentication bypass flaws that grant full administrative access. Patched versions are available, but opportunistic scanning from multiple IPs suggests many sites remain exposed.

The vulnerabilities, disclosed by Patchstack and credited to DigitalOcean's security team, are CVE-2026-61979 (CVSS 8.1) and CVE-2026-15981 (CVSS 9.8). Both stem from how the plugin's mo_saml_validate_signature() function handles signature verification. CVE-2026-15981 is particularly severe: PHP's openssl_verify() returns a tri-state integer where -1 indicates an OpenSSL processing error, but the loose boolean check treats this value as truthy, effectively approving malformed signatures as valid. An attacker can submit a crafted SAMLResponse with an attacker-controlled NameID and a deliberately malformed signature, triggering the error path and bypassing verification entirely — ultimately calling wp_set_auth_cookie() for any targeted account, including administrators. CVE-2026-61979, a related signature algorithm confusion issue, was fixed in version 17.0.5, while the authentication bypass was patched in version 17.0.6 (Standard edition).

DigitalOcean reportedly discovered the flaws after detecting an anomalous WordPress administrator session attempt originating from outside its trusted network. The attacker had already obtained a valid admin session cookie via the bypass but was blocked from further exploitation by network-level access controls on the admin panel. Patchstack has now observed widespread scanning activity from IPs including 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, and 64.225.25.188 — behavior consistent with opportunistic mass exploitation rather than a targeted campaign. Researchers warn that a public proof-of-concept now chains both flaws to escalate from unauthenticated access to full admin takeover.

WordPress administrators running the miniOrange SAML plugin should immediately update to version 17.0.6 or later and audit authentication logs for suspicious sessions from the listed IP addresses. Security teams can use a port scanner to verify exposed services, run a SSL/TLS checker to confirm certificate and signature handling on SAML endpoints, and perform a WHOIS lookup on any suspicious source IPs to enrich threat intelligence. Given the availability of exploit code, delayed patching will almost certainly result in compromise.