Clarissa Hana
Security researchers are alerting WordPress website administrators to a critical authentication bypass vulnerability affecting the widely used miniOrange SAML 2.0 Single Sign On (SSO) plugin. The exploit, which can be chained to achieve administrator-level access, poses a significant threat to sites relying on this plugin for secure single sign-on integration with enterprise identity providers. The vulnerabilities, identified as CVE-2026-61979 and CVE-2026-15981, were patched by the vendor in July, but a lack of comprehensive communication regarding the fix across all plugin editions has left many sites potentially exposed.
The Mechanics of the Authentication Bypass
The miniOrange SAML SSO plugin is designed to streamline user authentication by allowing WordPress sites to act as a Service Provider (SP), integrating with established identity platforms such as Microsoft Entra ID, Okta, Google Workspace, and OneLogin. This eliminates the need for users to manage separate WordPress credentials, offering a more convenient and often more secure login experience within an organizational context.
The exploitation of CVE-2026-61979 and CVE-2026-15981 hinges on a critical flaw in how the miniOrange plugin handles the cryptographic signatures within Security Assertion Markup Language (SAML) responses. SAML is an open standard for exchanging authentication and authorization data between parties, particularly between an identity provider and a service provider. A core security mechanism within SAML is the digital signature, which ensures the integrity and authenticity of the assertions made by the identity provider.
CVE-2026-61979: Signature Algorithm Misinterpretation
The first vulnerability, CVE-2026-61979, exploits a weakness in the plugin’s handling of signature algorithms. Typically, a Service Provider will enforce a specific, pre-configured algorithm for verifying the digital signature of SAML assertions. However, the vulnerable miniOrange plugin, when presented with a SAML response, accepts the signature algorithm specified within that response itself.
An attacker can leverage this by crafting a malicious SAML response that dictates the use of HMAC-SHA1 as the signing algorithm. In a typical SAML interaction, the identity provider signs the SAML assertion using a private key, and the service provider verifies this signature using the corresponding public key. However, due to the misinterpretation of the signature algorithm in this vulnerability, the miniOrange plugin mistakenly treats the public key of the identity provider (which is generally known or discoverable) as a shared secret key for HMAC-SHA1.
Because the attacker possesses this "shared secret" (the public key), they can then forge a SAML signature using HMAC-SHA1 that the plugin will erroneously validate as legitimate. This effectively bypasses the intended cryptographic verification process, allowing a forged assertion to be trusted.
CVE-2026-15981: OpenSSL Verification Error Handling
The second vulnerability, CVE-2026-15981, exacerbates the security risk by mismanaging OpenSSL verification errors. OpenSSL is a widely used cryptography toolkit. When validating digital signatures, cryptographic libraries often return specific error codes to indicate the outcome. One such error code, typically representing a verification failure, is -1.
The flaw in the miniOrange plugin causes it to interpret this OpenSSL verification error (-1) as a successful validation. This means that even if the digital signature within the SAML response is malformed or otherwise invalid according to standard cryptographic principles, the plugin will proceed as if the signature is legitimate.
Chaining the Vulnerabilities for Full Control
The true danger lies in chaining these two vulnerabilities. An attacker can first use CVE-2026-61979 to trick the plugin into using the identity provider’s public key as a shared secret for HMAC-SHA1. Then, using CVE-2026-15981, they can bypass the signature validation entirely, even if the signature itself is incorrect or non-existent, as the plugin will treat any verification error as a success. This combination allows an attacker to craft a SAML assertion that convincingly impersonates a legitimate user, including an administrator, thereby gaining unauthorized access to the WordPress backend.
Chronology of Vulnerability Discovery and Disclosure
The timeline of these vulnerabilities highlights a concerning communication gap:
- Prior to July 2026: The vulnerabilities existed within versions of the miniOrange SAML SSO plugin.
- July 2026: The security firm Patchstack identified and reported the vulnerabilities. The vendor, Xecurify (the maker of miniOrange plugins), released patches for these flaws.
- Post-July 2026: While patches were developed, the official advisory from miniOrange concerning these vulnerabilities reportedly focused solely on the free edition of the SAML SSO plugin. This omission left users of the six other paid editions unaware of the risks, despite fixes being available for those versions as well.
- August 16, 2026: A notable incident occurred when DigitalOcean flagged an anomalous WordPress administrator session originating from an IP address outside its trusted network. This event served as an early indicator of active exploitation.
- Ongoing: Investigations by Patchstack, triggered by the DigitalOcean incident, revealed that threat actors were actively chaining the two vulnerabilities. Exploitation attempts were detected originating from multiple IP addresses across Europe, Africa, and the United States. A publicly available proof-of-concept (PoC) exploit for the free edition further lowers the barrier for attackers.
The miniOrange Plugin Ecosystem and User Base
miniOrange offers a suite of security plugins developed by Xecurify. The SAML 2.0 Single Sign On plugin is a key component of their offering, enabling integration with enterprise identity management systems. The free version of the SAML SSO plugin has seen considerable adoption, with an reported 10,000 downloads on the WordPress plugin repository. Xecurify also boasts a broader customer base of 30,000 for its seven related plugins, underscoring the widespread use of their security solutions. This broad user base means that a significant number of WordPress sites could be vulnerable if not updated.
The plugin’s popularity stems from its ability to simplify user management and enhance security within organizations by leveraging established identity providers. However, this reliance on external identity providers also means that a compromise of the SSO integration itself can have cascading security implications, potentially granting attackers access to a wider range of organizational resources that are linked to the WordPress site.
Implications of the Disclosure Gap
The failure to issue a comprehensive advisory across all editions of the miniOrange SAML SSO plugin has had direct and severe consequences. Many organizations, particularly those using the paid versions of the plugin, remained unaware of the critical security flaw. This lack of awareness meant that updates were not applied, leaving their WordPress sites exposed to potential attacks.
According to Patchstack, this communication gap created a fertile ground for threat actors. By targeting sites that had not applied the patches for the paid editions, attackers could exploit the vulnerabilities with a higher probability of success. The incident at DigitalOcean, where an attacker successfully gained an admin session using an older version of the Standard edition of the plugin (version 16.1.9), serves as a concrete example of this exploitation in action.
The availability of a public PoC exploit further amplifies the threat. PoCs significantly lower the technical bar for attackers, enabling less sophisticated actors to replicate the exploit and launch their own campaigns. This increases the likelihood of widespread attacks, especially against unpatched systems.
Broader Impact and Analysis
The miniOrange SAML SSO vulnerability underscores several critical security considerations for businesses and website administrators:
- The Criticality of Comprehensive Vendor Communication: Software vendors have a responsibility to clearly and comprehensively communicate security vulnerabilities and their fixes to all affected users, regardless of whether they are using free or paid versions of a product. Opaque or incomplete advisories can lead to significant security gaps.
- The Risk of Outdated Plugins: This incident highlights the persistent danger of running outdated plugins, even those with robust functionality. Automatic update mechanisms are crucial, but manual verification and diligent patching are essential, especially when vendor communication is lacking.
- The Attack Surface of SSO Integrations: Single Sign-On solutions, while beneficial for user experience and security when implemented correctly, introduce a critical attack vector. A compromise in the SSO integration can grant attackers access to systems that are otherwise well-protected.
- The Importance of Security Auditing and Monitoring: Proactive security measures, including regular security audits, penetration testing, and robust monitoring systems, are vital for detecting anomalous activity. The DigitalOcean incident, while a consequence of a breach, was also a testament to their monitoring capabilities.
- The Need for Manual Updates for Paid Plugins: As Patchstack points out, WordPress’s built-in update notifications do not always extend to paid plugins. Website owners must take the initiative to check for updates for all their plugins, especially critical security-related ones, and apply them promptly. This requires a proactive approach to plugin management.
The ongoing scanning and exploitation attempts from multiple IP addresses indicate that the threat is active and evolving. The number of attacks could escalate further with the wider availability and understanding of the PoC exploit. Organizations that rely on the miniOrange SAML SSO plugin, or any other SSO solution, must prioritize verifying their plugin versions and applying the latest security patches to mitigate the risk of unauthorized access and potential data breaches. The reported success rate of attackers once they gain valid credentials, as suggested by supporting data indicating only 37% of their actions are blocked after initial access, further emphasizes the need for robust defense-in-depth strategies that go beyond simple authentication bypass prevention.
