Active Exploitation Targets Critical miniOrange SAML Flaws in WordPress
Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, tracked as CVE-2026-61979 and CVE-2026-15981, are being actively targeted in the wild. The flaws stem from signature algorithm confusion and improper handling of OpenSSL verification errors, allowing unauthenticated attackers to forge SAML assertions and acquire administrator session cookies. Because the vendor distributes multiple commercial editions under a shared plugin slug, many paid installations fail to show update alerts within the WordPress dashboard and require manual upgrades.
Commentary
The complexity of managing multiple paid version tracks under a single plugin slug creates a blind spot where automated scanners report false security. Site administrators running any commercial variant of miniOrange SAML SSO must verify their exact version branch rather than relying on dashboard notifications. Beyond applying vendor patches immediately, teams should audit authentication logs for unexpected administrator sessions and restrict access to the `/wp-admin` directory as a compensating control.
The Quote to Remember
“This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify()”