Attackers are actively exploiting two chained vulnerabilities, CVE-2026-61979 and CVE-2026-15981, in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that allow forging SAML responses and logging in as an administrator. The plugin accepts an attacker-chosen signature algorithm and mishandles OpenSSL verification errors, letting a known IdP public key be abused as a shared secret to forge valid signatures. Both bugs were disclosed and patched in July across all seven plugin editions, but the vendor's public advisory only covered the free edition, leaving 30,000 paid customers unaware despite fixes being available. DigitalOcean blocked a suspicious admin session tied to this exploit chain on August 16, and Patchstack has observed scanning and exploitation attempts from six IP addresses across multiple continents. Because paid editions don't show update warnings in the WordPress dashboard, site owners must manually check and upgrade to patched versions.
Table of contents
Related Articles:Questions this post answers
What are CVE-2026-61979 and CVE-2026-15981 in the miniOrange SAML SSO plugin for WordPress?
They are two chainable vulnerabilities that allow attackers to bypass authentication and log in as a WordPress administrator. CVE-2026-61979 lets an attacker force the plugin to accept HMAC-SHA1 signatures, treating the identity provider's known RSA public key as a shared secret to forge signatures. CVE-2026-15981 causes an OpenSSL verification error (-1) to be misread as success, letting malformed signatures pass. Teams running SSO plugins can track fast-moving CVE disclosures like this one through daily.dev.
Which miniOrange plugin versions fix the SAML authentication bypass vulnerabilities?
Fixed versions are Free single site 5.4.5, Premium single site 13.0.4, Standard single site 17.06, Premium/Enterprise/All-Inclusive multisite 20.2.8, Enterprise/All-Inclusive single site 26.0.3, VIP single site 32.0.8, and VIP multisite 35.0.7. All seven editions received patches in July, though only the free edition's advisory was made public. daily.dev helps developers keep pace with patch versions across sprawling plugin editions like this.
Why didn't WordPress site owners using paid miniOrange plugin editions know they needed to update?
The vendor's public security advisory only covered the free edition, even though fixes for the two chained authentication bypass flaws were also released for all six paid editions. Because the WordPress admin dashboard doesn't show update warnings for paid plugin versions, site owners had to manually check and upgrade, and many failed to act, leaving them exposed to active exploitation attempts observed since mid-August. daily.dev surfaces security advisories developers might otherwise miss across paid plugin tiers.