Hackers Target WordPress Sites in miniOrange Auth Bypass Attacks

Attackers are attempting to exploit two critical flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress.

The vulnerabilities can be chained to bypass authentication and log in as a WordPress administrator. Security researchers have already detected scanning and exploitation attempts against vulnerable websites.

Site owners using any affected miniOrange edition should manually check their installed version and update it as soon as possible.

Two flaws can forge SAML login responses

The miniOrange auth bypass issues are tracked as CVE-2026-61979 and CVE-2026-15981.

MiniOrange SAML SSO allows WordPress users to sign in through identity providers such as Microsoft Entra ID, Okta, Google Workspace and OneLogin. This can make the plugin an important part of a site’s authentication system.

The first flaw allows the plugin to accept the signature algorithm supplied in an incoming SAML response. An attacker can reportedly select HMAC-SHA1, causing the plugin to treat a public RSA key as a shared secret.

Because public keys are available to attackers, this can allow them to create a forged signature that the plugin accepts.

The second flaw affects how the plugin handles OpenSSL verification errors. It may treat a verification error as a successful result, allowing malformed signatures to pass validation.

Together, the bugs can let attackers create a fraudulent SAML response and gain administrator-level access.

Attacks have already been detected

Patchstack reported that DigitalOcean blocked a suspicious WordPress administrator session on August 16.

The session came from outside the organisation’s trusted network. Investigators found that attackers had used the two flaws against the Standard edition of the plugin, version 16.1.9, to obtain an administrator session cookie.

Patchstack has also observed opportunistic scanning and exploitation attempts from six IP addresses across Europe, Africa and the United States.

A proof-of-concept exploit for the free edition is publicly available. That could lead to more widespread attacks against unpatched WordPress sites.

Paid editions may not display update warnings

The vulnerabilities were disclosed and patched in July. However, the vendor advisory reportedly covered only the free edition, even though fixes were also released for six paid versions.

As a result, administrators using paid editions may not see an update warning inside the WordPress dashboard. They must check for updates manually.

The patched versions are:

• Free, single site: 5.4.5
• Premium, single site: 13.0.4
• Standard, single site: 17.06
• Premium, Enterprise and All-Inclusive multisite: 20.2.8
• Enterprise and All-Inclusive single site: 26.0.3
• VIP, single site: 32.0.8
• VIP, multisite: 35.0.7

WordPress administrators should update immediately

Website owners should identify every installed miniOrange SAML SSO edition and compare it with the patched version list.

They should then update vulnerable installations manually, rather than waiting for a dashboard notification. Administrators should also review recent admin accounts, login activity and session records for unexpected access.

The miniOrange auth bypass flaws affect a plugin designed to manage trusted sign-ins. That makes prompt patching especially important.