Loading vulnerability…
Unauthenticated Privilege Escalation in miniOrange SAML SP Single Sign On
CVE-2026-61979 is an unauthenticated privilege-escalation vulnerability in the miniOrange SAML SP Single Sign On plugin for WordPress. Affected versions accept the signature algorithm declared by an incoming SAML authentication response rather than strictly enforcing the configured algorithm. This algorithm-confusion condition can permit use of HMAC-SHA1 and cause the plugin to treat an identity provider RSA public key as HMAC key material, allowing an attacker to create a SAML assertion with a signature the plugin accepts. The vulnerability affects the plugin’s SAML signature-validation path and can lead to authentication as an arbitrary existing WordPress user.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can bypass SAML authentication and obtain a WordPress session as an arbitrary local account, including an administrator. Administrator-level access enables full takeover of the affected WordPress instance, including modification of site content and configuration, installation of plugins or code, creation of accounts, and access to data available to the compromised account.
If you can’t patch tonight, do this now.
Until upgrading is complete, restrict access to WordPress administrative and SAML SSO endpoints to trusted networks or an authenticated reverse proxy where operationally feasible. Disable the affected SAML SSO plugin or SAML login path if it is not required. Review WordPress authentication logs and active sessions for unexpected administrator logins, revoke suspicious sessions, rotate administrator credentials, and validate the integrity of administrator accounts, plugins, themes, and site configuration.
Patch, then assume compromise.
Upgrade miniOrange SAML SP Single Sign On to a vendor-fixed release. The CVE record identifies versions through 5.4.3 as affected and version 5.4.4 as unaffected. Verify the installed edition and version directly, as commercial editions use separate version lines and may require a manual plugin-package upload rather than an in-dashboard update. For the Standard edition, the reported fix is version 17.0.5.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.