Reported by 4 outlets

Timeline

1. original reporting

   Hackers target WordPress sites in miniOrange auth bypass attacks

   bleepingcomputer.com · 50d ago · August 24th, 2026

   Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators. The miniOrange SAML SSO plugin turns a WordPress site into a SAML service provider, letting users log in through corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin instead of separate WordPress credentials. Created by Xecurify, miniOrange is a family of seven plugins, with a free version that has 10,000 downloads and 30,000 customers for the other six. The two vulnerabilities observed in exploitation attempts are tracked as CVE-2026-61979 and CVE-2026-15981 and can be chained together to bypass authentication. Because the miniOrange SAML SSO plugin accepts the signature algorithm from incoming SAML responses instead of enforcing the configured one, an attacker can leverage CVE-2026-61979 to select HMAC-SHA1. This causes the plugin to treat the RSA public key from the identity provider (IdP) as the shared secret. Since the public key is known, the attacker can forge a signature that the plugin accepts as authentic. The second security issue, CVE-2026-15981, causes the plugin to treat an OpenSSL verification error (-1) as a successful result, allowing malformed signatures to pass validation. According to security firm Patchstack , the two vulnerabilities were publicly disclosed and fixed in July. However, the vendor’s adv

2. update from cyberpress.org

   Critical WordPress SAML SSO Flaws Enable Unauthenticated Admin Account Takeover

   cyberpress.org · 49d ago · August 25th, 2026

   Two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin could allow unauthenticated attackers to forge SAML assertions and access /wp-admin as any existing account, including administrators. The flaws, tracked as CVE-2026-61979 and CVE-2026-15981, carry a CVSS score of 9.8 and have reportedly been targeted by opportunistic scanning activity. DigitalOcean’s security team detected and blocked an anomalous WordPress administrator session attempt on its infrastructure, and then reproduced both bypasses in miniOrange’s Standard edition, version 16.1.9. Critical WordPress SAML SSO Flaws Patchstack coordinated vendor follow-up and expanded its vulnerability database coverage after discovering that the plugin’s distribution model obscured exposure across paid editions. Because an IdP public key is publicly available, an attacker could generate a forged assertion that the vulnerable plugin would accept as legitimate. CVE-2026-15981 involves improper handling of openssl_verify() return values. The function returns 1 for a valid signature, 0 for an invalid signature, and -1 on an OpenSSL error. Because the plugin used a loose Boolean check, PHP interpreted -1 as truthy, potentially allow

3. update from gbhackers.com

   Critical miniOrange SAML SSO Flaws Let Attackers Take Over WordPress Admin Accounts

   gbhackers.com · 49d ago · August 25th, 2026

   Research conducted by DigitalOcean’s security team and later […] The post Critical miniOrange SAML SSO Flaws Let Attackers Take Over WordPress Admin Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. mentioned by securityweek.com

   WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

   securityweek.com · 49d ago · August 25th, 2026