Full Report
Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators. The vulnerabilities, as disclosed by Patchstack, are listed below - CVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation
Analysis Summary
# Vulnerability: Authentication Bypass in miniOrange SAML 2.0 SSO
## CVE Details
- **CVE ID:** CVE-2026-15981 & CVE-2026-61979
- **CVSS Score:** 9.8 (Critical) for CVE-2026-15981; 8.1 (High) for CVE-2026-61979
- **CWE:** CWE-287 (Improper Authentication) / Signature Validation Flaw
## Affected Systems
- **Products:** Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress
- **Versions:**
- CVE-2026-61979: All versions prior to 17.0.5 (Standard Edition)
- CVE-2026-15981: All versions prior to 17.0.6 (Standard Edition)
- **Configurations:** Systems utilizing SAML SSO for WordPress user authentication.
## Vulnerability Description
The primary flaw (CVE-2026-15981) exists within the `mo_saml_validate_signature()` function. The plugin performs a loose boolean check on the integer returned by PHP’s `openssl_verify()`. Because `openssl_verify()` returns `-1` on error, and PHP treats `-1` as `true` in a loose boolean comparison, a malformed signature that triggers a processing error is treated as a successful verification.
CVE-2026-61979 involves a signature algorithm confusion flaw that similarly allows for unauthenticated privilege escalation.
## Exploitation
- **Status:** Exploited in the wild; PoC available.
- **Complexity:** Low
- **Attack Vector:** Network
- **Observation:** Attackers are using opportunistic scanning to target WordPress sites. Exploitation involves sending a crafted `SAMLResponse` with a targeted `NameID` (e.g., an administrator's username) and a malformed signature to bypass authentication and receive an active session cookie.
## Impact
- **Confidentiality:** High (Full access to user data and admin panels)
- **Integrity:** High (Ability to modify site content, users, and settings)
- **Availability:** High (Potential for site takeover or deletion)
## Remediation
### Patches
- **Standard Edition:** Update to version **17.0.6** or higher.
- Users of other editions (Premium, Enterprise, etc.) should check with miniOrange for the corresponding patched version numbers, as all editions are reportedly affected.
### Workarounds
- No official workarounds provided; immediate patching is the only recommended course of action due to active exploitation.
## Detection
- **Indicators of Compromise (IP Addresses):**
- 207[.]211[.]214[.]41
- 79[.]127[.]224[.]14
- 102[.]91[.]71[.]83
- 162[.]243[.]116[.]148
- 84[.]201[.]6[.]54
- 64[.]225[.]25[.]188
- **Detection Methods:** Review WordPress audit logs for anomalous administrator logins from unrecognized IP addresses, particularly those bypassing standard SSO workflows.
## References
- **Vendor/Researcher Advisory:** hxxps://patchstack[.]com/articles/one-slug-seven-editions-the-miniorange-saml-sso-bug-that-let-anyone-log-in-as-your-wordpress-admin/
- **CVE Records:**
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-15981
- hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-61979