Unauthenticated attackers can hijack WordPress administrator accounts via miniOrange SAML 2.0 plugin flaws

Summary

Threat actors are conducting opportunistic attacks against WordPress websites using two vulnerabilities in the miniOrange SAML 2.0 Single Sign-On (SSO) plugin. These flaws enable attackers to bypass authentication and log in as any existing user on a target site, including those with administrative privileges.

While the free edition of the plugin is installed on more than 10,000 WordPress sites, the vulnerabilities also impact several paid and enterprise versions. Security researchers from DigitalOcean and Patchstack have observed these as opportunistic attacks rather than a targeted campaign, where attackers attempt to exploit any site running the vulnerable plugin regardless of its specific edition or version.

Technical details

The most severe flaw, CVE-2026-15981 (CVSS 9.8), involves an authentication bypass within the mo_saml_validate_signature() function. The vulnerability stems from a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify() function.

Because the function performs a loose check, an error return value of -1 is evaluated as truthy. An attacker can exploit this by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value. This malformed signature triggers an OpenSSL processing error, which the plugin incorrectly treats as a successful signature verification. This allows the attacker to trigger wp_set_auth_cookie() for the targeted account without a valid signature.

A second vulnerability, CVE-2026-61979 (CVSS 8.1), allows for unauthenticated privilege escalation in versions up to and including 5.4.3.

Affected products and fixed versions

The vulnerabilities affect the miniOrange SAML 2.0 Single Sign-On plugin for WordPress. Because the developer uses different versioning systems for paid and enterprise editions, users must manually verify their versions to ensure they are protected.

Why this matters for defenders

The current patching situation is problematic due to a lack of clear communication from the developer. While the free edition has an advisory for version 5.4.5, the update is listed as a "bugfix" rather than a security patch.

For users of paid or enterprise editions, there has been no official notification regarding these risks. This "silent-patch" scenario is dangerous because attackers do not need to know which edition a site is running; they can simply attempt the exploit against any site with the plugin installed. If you are running a paid version, you cannot rely on automatic notifications to signal that your site is vulnerable.

Defender guidance

Check your WordPress plugin installation immediately. If you are running the miniOrange SAML 2.0 SSO plugin, you must update to version 5.4.5 or later to mitigate these risks.

• For Free Edition users: Update to version 5.4.5 or later.
• For Paid/Enterprise users: Manually check your version number. If it is below 5.4.5, update immediately, as the versioning system may not clearly indicate the security fix.
• General Action: If you cannot update the plugin immediately, contact your web developer or hosting provider to facilitate the update.