← News
/DISPATCH · 2026-08-26

miniOrange SAML WordPress Plugin: Two Auth-Bypass Vulnerabilities, CISA Warns Attacks Are In the Wild

WordPress miniOrange SAML 2.0 SSO plugin: two auth-bypass bugs, CVE-2026-61979 and CVE-2026-15981. Combined, an attacker can log in as any admin with no credentials. DigitalOcean Security confirmed in-the-wild exploitation.

Incident Overview

In August 2026, one of the most widely deployed SAML 2.0 SSO plugins in the WordPress ecosystem — Xecurify miniOrange SAML 2.0 Single Sign-On — was disclosed with two critical auth-bypass bugs: CVE-2026-61979 (CVSS 8.1) and CVE-2026-15981 (CVSS 9.8). Both are CWE-287/295. Root cause: `mo_saml_validate_signature()` treats OpenSSL return values too loosely. OpenSSL returns 0 on verify failure; that was wrongly treated as success (true). DigitalOcean Security found anomalous admin session requests in their own control-plane logs, confirmed both bugs are under active in-the-wild exploitation, and multiple IP ranges are opportunistically scanning internet-exposed WordPress sites.

The free miniOrange SAML build was fixed in earlier versions. A substantial fraction of paid users still have not upgraded. Open-source Patchstack and commercial defenders have publicly released detection PoCs, lowering the exploit bar further.

Technical Details

CVE-2026-61979: Signature Algorithm Confusion

miniOrange has an algorithm-confusion defect when verifying SAML response signatures. An attacker tampers with the signature algorithm identifier in the SAML Response and attaches a crafted SignInfo, bypassing the intended strict algorithm allowlist. Historically miniOrange maintained the SAML algorithm allowlist poorly. An attacker can specify an empty or weak algorithm; the plugin takes a loose path and accepts the signature.

CVE-2026-15981: `openssl_verify()` Boolean Check Error

Critical function, simplified:

$result = openssl_verify($data, $signature, $public_key, OPENSSL_ALGO_SHA256);
if ($result) {
    // Verification passed: allow user login
}
if ($result === 1) {
    // The true semantic branch for "passed and signature valid"
}
// Default branch has no exception handling

`openssl_verify()` returns 0 on verification failure, -1 on invalid signature, 1 on success. Any return value was loosely treated as true. Attacker crafts a well-formed SAMLResponse with a bad signature. `$result` is -1 or 0. The loose condition still holds. The verifier returns success. Login is allowed.

Chained Path

Impact Assessment

Combined CVSS puts this at internet-scale high severity:

Remediation

Detection Rules

# WordPress access logs: concentrated burst of anomalous signature failures at the SAML entry point
awk '$7 ~ /SAML/' /var/log/nginx/access.log | grep -E 'SigAlg.*http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig-more' | awk '{print $1}' | sort | uniq -c | sort -rn | head

# Database: anomalous admin session generation
SELECT user_id, IP, FROM_UNIXTIME(issued) FROM wp_usermeta
WHERE meta_key='session_tokens' AND issued > UNIX_TIMESTAMP(NOW() - INTERVAL 1 HOUR);

# File drop: uploaded/modified theme/plugin files
find /var/www/html/wp-content -name '*.php' -newer /var/www/html/wp-config.php -mmin -60

References