Hackers are actively exploiting two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, according to security firm Patchstack. The flaws can be chained together to forge SAML responses and allow an attacker to log in as an administrator. The plugin, created by Xecurify, lets WordPress sites act as SAML service providers, enabling users to authenticate through corporate identity platforms like Microsoft Entra ID, Okta, Google Workspace, or OneLogin instead of using separate WordPress credentials. The product family includes a free version with 10,000 downloads and six paid editions serving 30,000 customers.
The first vulnerability, tracked as CVE-2026-61979, stems from the plugin accepting the signature algorithm from incoming SAML responses rather than enforcing the configured one. An attacker can leverage this to select HMAC-SHA1, which causes the plugin to treat the identity provider鈥檚 RSA public key as the shared secret. Because that public key is publicly known, the attacker can forge a signature the plugin will accept as authentic. The second issue, CVE-2026-15981, makes the plugin treat an OpenSSL verification error as a successful result, allowing malformed signatures to pass validation.
Patchstack reports that both vulnerabilities were publicly disclosed and fixed in July, but the vendor鈥檚 advisory only covered the free edition. The six paid editions received fixes without an accompanying alert, leaving many sites running those versions unaware of the risk. As a result, a significant number of paid-version users took no action to patch, creating an opening for threat actors. The disclosure gap is notable because the WordPress administrator dashboard will not show update warnings for the paid versions, so site owners must manually upgrade to a patched release.
Evidence of active exploitation has already surfaced. On August 16, DigitalOcean blocked an anomalous WordPress administrator session that originated outside its trusted network. Patchstack鈥檚 data shows opportunistic scanning and exploitation attempts are underway, launched from six IP addresses located across Europe, Africa, and the United States. The U.S. angle is direct here, as American WordPress site owners running the paid plugin editions are among those at risk if they have not manually updated.
A proof-of-concept exploit targeting the free edition is also publicly available, which could accelerate the pace of attacks. Patchstack warns that overall prevention metrics can obscure what happens after initial access, noting that once attackers use valid credentials, prevention drops sharply. The Blue Report 2026, which measures defenses technique by technique across 338 million simulations in customer production environments, supports that broader observation. For now, administrators using any miniOrange SAML SSO edition should verify their version and apply the patched release manually, as the standard WordPress update prompt will not appear for paid licenses.
More cybersecurity news from TechManNews.
