Hackers Chain Two miniOrange WordPress Plugin Bugs to Log in as Admin

Key points

• Attackers are exploiting two authentication bypass flaws, CVE-2026-61979 and CVE-2026-15981, in the miniOrange SAML 2.0 Single Sign On plugin for WordPress to log in as site administrators.
• Fixes shipped in July 2025, but the vendor's public advisory only covered the free edition, leaving six paid versions quietly patched with no alert to customers.
• Security firm Patchstack traced an attack on August 16, when DigitalOcean blocked a suspicious admin session on a site running the Standard edition version 16.1.9.
• Scanning and exploitation are coming from six IP addresses across Europe, Africa and the United States, and a working proof-of-concept for the free edition is already public.
• WordPress will not show an update prompt for the paid versions, so site owners must upgrade by hand.

Criminals are breaking into WordPress websites by tricking a popular login plugin into believing they are the site owner.

The plugin is called miniOrange SAML 2.0 Single Sign On, made by a company called Xecurify. It lets a WordPress site accept logins from corporate identity services like Microsoft Entra ID, Okta, Google Workspace or OneLogin, so staff use their work account instead of a separate WordPress password.

That is a useful thing. It is also, right now, a soft target.

How are the hackers getting in?

They are chaining two bugs together to forge a valid login. First reported by BleepingComputer, the attacks abuse CVE-2026-61979 and CVE-2026-15981, two flaws in how the plugin checks the digital signature on an incoming login message.

Here is the plain version. When you sign in through a service like Okta, Okta sends the WordPress site a signed message saying "yes, this is really Jane." The plugin is supposed to check that signature against Okta's public key, a bit of cryptographic ID that everyone can see but only Okta can sign with.

The first bug lets the attacker pick which signing method the plugin uses to check the message. Choose the wrong one, and the plugin treats Okta's public key, which anyone can download, as if it were a shared password. At that point the attacker can sign their own fake message and the plugin waves it through.

The second bug is simpler and, honestly, more embarrassing. When the underlying OpenSSL library returns an error code of -1, meaning "I could not verify this," the plugin reads that as success. Malformed signatures get accepted.

If this feels familiar to anyone who has read about classic SAML attacks over the years, it should. This is the same family of signature-confusion tricks that have haunted single sign-on since the mid-2010s, with a WordPress twist.

Why did paid customers miss the patch?

Because nobody told them. Patches went out in July, but Xecurify's public advisory only mentioned the free edition. The six paid editions were fixed in the code, quietly, with no security notice attached.

Many paying customers assumed there was nothing to do. WordPress does not display update warnings for these paid versions, so the admin dashboard stays silent even on a vulnerable site.

Here are the fixed versions to check against:

What does the attack look like in the wild?

On August 16, DigitalOcean blocked a WordPress administrator session that had appeared out of nowhere, from outside the customer's trusted network. Patchstack investigated and found the two bugs chained together against the Standard edition, version 16.1.9, to hand the attacker an admin session cookie.

Since then, Patchstack has recorded scanning from six IP addresses across three continents. A working exploit for the free edition is public, which usually means the volume goes up, not down.

What should site owners do now?

If your site uses any miniOrange SAML SSO plugin, open the plugin file in your WordPress install and check the version number against the table above. Upgrade by hand if you are on a paid edition. Then check your list of administrator accounts for anyone you do not recognise, and force a session reset for the ones you do.