Attacks on the miniOrange SAML SSO plugin for WordPress: login bypass grants admin rights

Patchstack has reported active attempts to exploit two serious vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress. Both are unauthenticated authentication bypasses that let an attacker log in to a site under the account of any existing user, including the administrator.

Two vulnerabilities

The first — CVE-2026-61979 (CVSS 8.1) — is a privilege escalation stemming from signature algorithm confusion. It was fixed in version 17.0.5 of the Standard edition.

The second and more dangerous one — CVE-2026-15981 (CVSS 9.8) — was patched in version 17.0.6. The root cause lies in the mo_saml_validate_signature() function, which performs a loose boolean check on the result of the PHP function openssl_verify(). The latter returns three possible values, and under such a check the error code -1 is treated as “true,” that is, as a successful signature verification. As a result, all an attacker has to do is send the plugin a crafted SAMLResponse with a NameID they control and a deliberately corrupted signature: OpenSSL stumbles on the processing, the check is bypassed entirely, and wp_set_auth_cookie() is called for the specified account.

How it was discovered

Both issues were found by DigitalOcean's security team. The cloud infrastructure provider noticed an anomalous WordPress administrator session attempt from outside the trusted network. The attacker had already managed to obtain an administrative session cookie via the bypass, but got stuck: operations within the control panel itself were additionally restricted to the trusted network.

Mass scanning

Patchstack recorded scanning from several IP addresses and concluded that this is more of an opportunistic sweep than a targeted campaign. According to the researchers, the attackers throw the exploit at every site with the plugin installed, without even checking which edition and version it is running.

Site owners are strongly advised to install the updates as soon as possible — all the more so since proof-of-concept code is already available that chains both vulnerabilities together to gain full control over the vulnerable resource.

Source: The Hacker News