Active Scanning Targets miniOrange SAML Bugs in WordPress
Attackers are attempting to exploit two severe authentication flaws in Xecurify’s miniOrange SAML 2.0 Single Sign On plugin for WordPress. The issues can allow an unauthenticated attacker to sign in as any existing WordPress user, including an administrator, and scanning activity has already been observed.
The vulnerabilities are tracked as CVE-2026-61979, with a CVSS score of 8.1, and CVE-2026-15981, rated 9.8. Patchstack said the flaws affect the plugin’s Standard edition and can be chained using publicly available proof-of-concept code to obtain administrative privileges on susceptible sites.
Two paths to unauthorized WordPress access
CVE-2026-61979 is an unauthenticated privilege-escalation flaw caused by signature algorithm confusion. Xecurify fixed it in version 17.0.5 of the Standard edition.
The more severe CVE-2026-15981 is an authentication bypass fixed in Standard edition version 17.0.6. It lies in the mo_saml_validate_signature() function, which uses a loose boolean check on the tri-state integer returned by PHP’s openssl_verify() function.
An OpenSSL processing error returns -1, but the loose check evaluates that value as truthy and treats the signature verification as successful. An attacker can submit a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature, then cause the plugin to invoke wp_set_auth_cookie() for the selected account.
Observed activity points to broad scanning
Patchstack credited DigitalOcean’s security team with reporting the vulnerabilities. DigitalOcean identified them after detecting an anomalous attempt to establish a WordPress administrator session from outside its trusted network. The attacker had obtained an administrator session cookie, Patchstack said, but administrative-panel operations remained restricted by the trusted network.
Patchstack recorded scanning from 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, and 64.225.25.188. The distribution suggests opportunistic scanning rather than a targeted campaign, with attempts apparently directed at sites running the plugin without first determining their edition or version.
What site operators should do
Organizations running miniOrange SAML 2.0 Single Sign On should establish whether they use the Standard edition and apply the latest available fixes, including version 17.0.6 for the authentication-bypass issue. They should also review WordPress administrator sessions and authentication activity for unexpected access, particularly because proof-of-concept code can chain the two flaws into site takeover.
The practical business implication is straightforward: a SAML integration can become a direct administrative access path, so patch status and administrator-session monitoring need to be treated as urgent controls for affected WordPress deployments.