Exploitable Auth Bypass in miniOrange SAML 2.0 SSO for WordPress

Two critical authentication bypass vulnerabilities have been discovered in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing an unauthenticated attacker to log in as any user, including administrators. According to Patchstack, opportunistic scanning with exploitation attempts has already been observed, and public proof-of-concept (PoC) code is available. Site owners using this plugin must immediately update to version 17.0.6 (Standard edition) or higher.

Technical details of the vulnerabilities

Two vulnerabilities have been identified and assigned CVE identifiers:

• CVE-2026-61979 (CVSS 8.1) — unauthenticated privilege escalation caused by signature algorithm confusion. Fixed in version 17.0.5 for the Standard edition.
• CVE-2026-15981 (CVSS 9.8) — authentication bypass via accepting incorrect signatures as valid. Fixed in version 17.0.6 for the Standard edition.

The root cause of the most critical vulnerability, CVE-2026-15981, warrants a closer look. The mo_saml_validate_signature() function performs a loose boolean check of the value returned by the PHP function openssl_verify(). This function can return three possible values: 1 (signature is valid), 0 (signature is invalid), and -1 (processing error). The problem is that with non-strict comparison the value -1 is interpreted as truthy—that is, as a successful signature verification.

This is a classic PHP return-value handling mistake that turns an OpenSSL error into a full verification bypass. An attacker crafts a SAML response with an arbitrary NameID value (pointing to the targeted user) and a deliberately malformed signature that triggers a processing error in OpenSSL. As a result, the plugin calls wp_set_auth_cookie() for the target account, granting the attacker a full session.

Observed activity

According to reports, the DigitalOcean security team discovered the vulnerabilities after detecting an anomalous attempt to create a WordPress administrator session from outside the trusted network. Patchstack states that the attacker had already obtained an administrator session cookie via authentication bypass, but further actions in the admin dashboard were blocked by network restrictions—the administrative interface was accessible only from the trusted network.

This incident clearly illustrates the value of the defense-in-depth principle: even when the vulnerability was successfully exploited, additional network restrictions prevented full compromise.

Patchstack recorded scanning activity from the following IP addresses:

• 207.211.214.41
• 79.127.224.14
• 102.91.71.83
• 162.243.116.148
• 84.201.6.54
• 64.225.25.188

In Patchstack’s assessment, the diversity of IP addresses points to opportunistic scanning rather than a targeted campaign. Attackers are presumably applying the exploit to all sites with the plugin installed, without checking the specific edition or version. It is important to note that the data on active exploitation is based on a single source and has not been independently confirmed; neither of the CVEs has been added to the CISA KEV catalog.

Impact assessment

The miniOrange SAML 2.0 SSO plugin is used by organizations integrating WordPress with enterprise single sign-on systems. This means that primarily corporate sites, intranet portals, and e-commerce platforms where SAML authentication is used for centralized access management are at risk.

The existence of public PoC code that reportedly allows chaining both vulnerabilities to obtain administrative privileges significantly lowers the barrier for attackers. Successful exploitation gives full control over a WordPress site: from injecting malicious code and redirecting traffic to using the compromised site as a staging ground for further attacks on the organization’s infrastructure.

Recommendations for protection

1. Immediate update: update the miniOrange SAML 2.0 SSO plugin to at least version 17.0.6 (Standard edition). If you use a different edition of the plugin, check with the vendor for patch availability.
2. Log review: analyze web server logs for suspicious POST requests to SAML response processing endpoints, especially from the IP addresses listed above.
3. Session audit: review the list of active WordPress administrator sessions. Force-terminate all sessions and reset administrator passwords if any signs of unauthorized access are detected.
4. Restrict access to the admin panel: the DigitalOcean case confirms the effectiveness of restricting access to /wp-admin/ by IP address or via VPN as an additional layer of protection.
5. IOC blocking: consider adding the specified IP addresses to WAF blocklists, after first verifying their relevance to your environment.

Given the criticality of CVE-2026-15981 (CVSS 9.8), the existence of public PoC code, and the observed scanning activity, updating the miniOrange SAML 2.0 SSO plugin to version 17.0.6 must be treated as a top priority—within the next few hours, not days. For sites where immediate updating is not possible, a temporary mitigation may be to deactivate the plugin until the patch can be applied.