Loading vulnerability…
Authentication bypass in miniOrange SAML SSO signature verification
CVE-2026-15981 is an authentication bypass vulnerability in the miniOrange SAML Single Sign On – SSO Login plugin family for WordPress. The mo_saml_validate_signature() function performs a loose boolean check on the tri-state integer returned by PHP's openssl_verify(). An OpenSSL processing error returns -1, which evaluates as true in PHP and is incorrectly accepted as successful signature verification. An unauthenticated attacker can submit a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature that triggers this error. The plugin then calls wp_set_auth_cookie() for the targeted existing WordPress account, allowing impersonation of users, including administrators. The free edition is affected through version 5.4.4; independently versioned paid editions are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses SAML authentication and grants an authenticated session as any existing WordPress user, including administrators. Administrator impersonation can enable takeover of the affected WordPress site. Exploitation attempts and administrator-session acquisition involving this vulnerability and CVE-2026-61979 have been observed; some incident accounts describe chaining the two flaws, while the vulnerability-specific description establishes a standalone malformed-signature bypass.
If you can’t patch tonight, do this now.
If immediate upgrading is not possible, apply the applicable narrowly scoped Patchstack hotfix. Disable the affected SSO component or restrict access where feasible until patched. Restrict administrator operations to trusted networks as defense in depth: this control has blocked use of an attacker-obtained administrator session, but does not correct signature validation or prevent session-cookie issuance.
Patch, then assume compromise.
Install the fixed release or a later release for the deployed edition: Free single-site 5.4.5; Premium single-site 13.0.4; Standard single-site 17.0.6; Premium/Enterprise/All-Inclusive multisite 20.2.8; Enterprise/All-Inclusive single-site 26.0.3; VIP single-site 32.0.8; or VIP multisite 35.0.7. Verify the edition and its independent version line rather than comparing every installation against the free edition's version number. Affected paid installations, particularly Standard 16.x installations moving to 17.x, may require manual upload of the patched package because dashboard update notifications or cross-line upgrades may not be offered.
2 exploits validated by Mallory's analysis.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.