miniOrange WordPress SSO Flaws Exploited for Administrator Account Takeover

Attackers are actively exploiting two critical authentication bypass flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing forged SAML responses to grant administrator access on vulnerable sites. The bugs, tracked as CVE-2026-61979 and CVE-2026-15981, can be chained so the plugin accepts attacker-controlled authentication data by misusing an IdP RSA public key as a shared secret and treating an OpenSSL verification error as a valid signature check.

Security reporting says exploitation attempts and opportunistic scanning are already underway, with one August incident involving a suspicious WordPress admin session that DigitalOcean linked to exploitation of the Standard edition plugin version 16.1.9. Although fixes were released in July, the vendor advisory reportedly covered only the free edition, leaving many paid-edition customers unaware because those versions do not display update warnings in the WordPress dashboard; organizations using identity providers such as Microsoft Entra ID, Okta, and Google Workspace may remain exposed if they have not manually upgraded, especially now that a public proof-of-concept is available.