Hackers are actively targeting **WordPress** sites running the **miniOrange SAML 2.0 Single Sign On** plugin, exploiting two critical authentication bypass vulnerabilities. These flaws enable threat actors to forge SAML responses and gain unauthorized administrative access. ### The miniOrange SAML SSO Plugin The **miniOrange SAML SSO** plugin transforms a **WordPress** site into a SAML service provider. This allows users to authenticate through corporate identity platforms such as **Microsoft Entra ID**, **Okta**, **Google Workspace**, or **OneLogin**, rather than using separate **WordPress** credentials. The plugin, developed by **Xecurify**, offers a free version with 10,000 downloads and six paid editions serving 30,000 customers. ### Chained Vulnerabilities: CVE-2026-61979 and CVE-2026-15981 The two vulnerabilities under active exploitation are tracked as **CVE-2026-61979** and **CVE-2026-15981**. When chained, they facilitate a complete authentication bypass. **CVE-2026-61979** allows an attacker to dictate the signature algorithm from incoming SAML responses. By selecting HMAC-SHA1, the plugin mistakenly treats the RSA public key from the identity provider (IdP) as a shared secret. Since the public key is publicly known, attackers can then forge a signature that the plugin accepts as legitimate. **CVE-2026-15981** exacerbates the issue by causing the plugin to interpret an OpenSSL verification error (-1) as a successful validation. This allows malformed signatures to pass through the security checks, completing the bypass. ### Disclosure Gaps and Patching Confusion Security firm **Patchstack** first disclosed and saw fixes for these vulnerabilities in July. However, the vendor's advisory primarily highlighted the free edition, leaving the six paid editions without explicit alerts, despite available patches. This incomplete disclosure meant many sites using the paid versions of the plugin remained unaware of the critical risk, creating a window of opportunity for attackers. The following versions address the two flaws: * Free, single site – 5.4.5 * Premium, single site – 13.0.4 * Standard, single site – 17.06 * Premium/Enterprise/All-Inclusive, multisite – 20.2.8 * Enterprise/All-Inclusive, single site – 26.0.3 * VIP, single site – 32.0.8 * VIP, multisite – 35.0.7 ### Active Exploitation and Manual Updates Required **Patchstack** reported an incident on August 16 where **DigitalOcean** blocked an anomalous **WordPress** administrator session. Investigation revealed attackers had chained these flaws to obtain an admin session cookie via the Standard edition plugin, version 16.1.9. Opportunistic scanning and exploitation attempts are ongoing, originating from various IP addresses across Europe, Africa, and the United States. A public proof-of-concept (PoC) exploit for the free edition is also available, suggesting a potential increase in attack frequency. **Patchstack** warns that the **WordPress** administrator dashboard will not display update warnings for the paid versions of the plugin. Site owners must manually upgrade to a patched release to secure their installations against these active threats.