Full Report
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators. [...]
Analysis Summary
# Vulnerability: Authentication Bypass in miniOrange SAML 2.0 SSO for WordPress
## CVE Details
- **CVE ID:** CVE-2026-61979 and CVE-2026-15981
- **CVSS Score:** Not explicitly listed in text, but categorized as **Critical** (estimated 9.8 - 10.0 range due to remote unauthenticated admin access).
- **CWE:** Improper Authentication / Cryptographic Issues (Signature Validation)
## Affected Systems
- **Products:** miniOrange (Xecurify) SAML 2.0 Single Sign On plugin for WordPress.
- **Versions:**
- Free (Single Site): Versions prior to 5.4.5
- Premium (Single Site): Versions prior to 13.0.4
- Standard (Single Site): Versions prior to 17.06
- Premium/Enterprise/All-Inclusive (Multisite): Versions prior to 20.2.8
- Enterprise/All-Inclusive (Single Site): Versions prior to 26.0.3
- VIP (Single Site): Versions prior to 32.0.8
- VIP (Multisite): Versions prior to 35.0.7
- **Configurations:** Systems acting as a SAML Service Provider (SP) using these plugins to authenticate via third-party Identity Providers (IdP).
## Vulnerability Description
The vulnerability consists of two flaws that can be chained to bypass authentication entirely:
1. **CVE-2026-61979:** The plugin fails to enforce a specific signature algorithm, instead accepting the algorithm provided in the incoming SAML response. Attackers can specify HMAC-SHA1, which forces the plugin to treat the IdP's RSA public key as a shared secret. Because public keys are not confidential, attackers can use them to forge valid SAML signatures.
2. **CVE-2026-15981:** An implementation error where the plugin interprets an OpenSSL verification error code of `-1` as a "success," allowing malformed or invalid signatures to bypass security checks.
## Exploitation
- **Status:** **Exploited in the wild.** Active scanning and exploitation attempts have been observed since mid-August 2026.
- **Complexity:** Low (Attacker uses publicly known information to forge responses).
- **Attack Vector:** Network (Remote).
- **PoC Available:** Yes (Publicly available for the Free edition).
## Impact
- **Confidentiality:** High (Full access to the WordPress administrator dashboard).
- **Integrity:** High (Ability to modify site content, users, and settings).
- **Availability:** High (Potential for site takeover or deletion).
## Remediation
### Patches
Update to the following versions (or higher) immediately:
- Free (Single Site): **5.4.5**
- Premium (Single Site): **13.0.4**
- Standard (Single Site): **17.06**
- Premium/Enterprise/All-Inclusive (Multisite): **20.2.8**
- Enterprise/All-Inclusive (Single Site): **26.0.3**
- VIP (Single Site): **32.0.8**
- VIP (Multisite): **35.0.7**
### Workarounds
*Note: The WordPress dashboard may not display update notifications for paid versions of this plugin.* Users must **manually** download and install the latest versions from the vendor's portal.
## Detection
- **Indicators of Compromise:**
- Anomalous administrator sessions originating from unexpected IP addresses (specifically those outside of trusted corporate networks).
- SAML responses using HMAC-SHA1 instead of the organization's standard (e.g., RSA-SHA256).
- **Detection Methods:** Review WordPress audit logs for unauthorized administrative actions and check plugin versioning against the list of affected versions.
## References
- Patchstack Advisory: hxxps[://]patchstack[.]com/articles/one-slug-seven-editions-the-miniorange-saml-sso-bug-that-let-anyone-log-in-as-your-wordpress-admin/
- WordPress Plugin Repository: hxxps[://]wordpress[.]org/plugins/miniorange-2-factor-authentication/
- Vendor Website: hxxps[://]www[.]miniorange[.]com/