miniOrange SAML SSO CVE-2026-61979 and CVE-2026-15981: The Dual Authentication Bypass That Left Every Paid WordPress Site Invisible to Every Vulnerability Database

digital interactive web development hero image

The Dashboard Said You Were Safe. You Weren’t.

Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin were publicly disclosed on August 21, 2026. Both carry a CVSS score of 9.8. Both allow an unauthenticated attacker to forge a SAML assertion and land in /wp-admin as any existing user on the site, including administrators.

Neither was discovered through a bounty program. The DigitalOcean security team found active exploitation in the wild, blocked a forged administrator session appearing outside their trusted network range, then reverse-engineered both bugs down to the exact lines of code responsible. That is the clean version of this story. The messier version is more instructive for anyone managing WordPress sites at scale.

One Slug, Seven Version Lines, Six Silent Patches

miniOrange ships this plugin under a single WordPress.org slug: miniorange-saml-20-single-sign-on. One slug, one listing in every dashboard and scanner. But behind that slug sit seven independently versioned product editions, each with its own numbering scheme that never overlaps with the others.

When public advisories for CVE-2026-61979 and CVE-2026-15981 were published, they covered only the free edition, vulnerable through version 5.4.4 and fixed in 5.4.5. The six paid editions, Premium, Standard, Enterprise, All-Inclusive, VIP single-site, and VIP multisite, were patched without a public changelog entry or security advisory.

Every vulnerability database read those advisories against the slug. Standard edition 16.1.9, confirmed vulnerable by DigitalOcean, carries a version number far above 5.4.5. Every scanner therefore reported: not affected, confirmed patched, safe to ignore. None of that was true. Patchstack published the full version matrix on August 21 after miniOrange provided it. Prior to that date, no public database had the paid-edition ranges.

| Edition | Vulnerable Through | Patched In | |—|—|—| | Free | 5.4.4 | 5.4.5 | | Premium | 13.0.3 | 13.0.4 | | Standard | 17.0.5 | 17.0.6 | | Premium/Enterprise/All-Inclusive Multisite | 20.2.7 | 20.2.8 | | Enterprise/All-Inclusive | 26.0.2 | 26.0.3 | | VIP (single-site) | 32.0.7 | 32.0.8 | | VIP (multisite) | 35.0.6 | 35.0.7 |

If you manage sites running any paid tier of this plugin, your scanner did not catch it. Your WordPress dashboard did not catch it either. Standard edition 16.x has no update prompt pointing to 17.x. The jump between major version lines requires a manual plugin upload. There is no automatic update mechanism covering it.

The Two Bugs

CVE-2026-61979 is a signature algorithm confusion flaw. The plugin lets incoming SAML responses specify their own signature algorithm. An attacker sets SignatureMethod to HMAC-SHA1. The plugin then allows the IdP’s RSA public key PEM to serve as the HMAC secret. The public key is public by definition. An attacker fetches it from the identity provider’s metadata endpoint, signs a forged assertion using it as the HMAC secret, and the plugin accepts that assertion as genuine. The vulnerable code path runs through Utilities.php:246-250 and the bundled XMLSecurityKey.php:216-218. miniOrange fixed this in Standard edition version 17.0.5.

CVE-2026-15981 is an OpenSSL tri-state evaluation error. PHP’s openssl_verify() returns 1 for a valid signature, 0 for invalid, and -1 when OpenSSL itself hits an internal error. The plugin evaluated this return value as a boolean. In PHP, -1 is truthy. A malformed signature that trips OpenSSL’s error handling path gets accepted as a valid signature. The flaw sits at XMLSecurityKey.php:486-494 and Utilities.php:252. miniOrange fixed this in Standard edition 17.0.6. Either bug alone grants unauthenticated admin access.

What Exploitation Actually Looked Like

DigitalOcean did not catch a scanner hitting the SAML endpoint. They caught what came next. An anomalous WordPress administrator session attempt appeared from outside their trusted network range. The attacker had already successfully forged the assertion and obtained an admin session cookie. Network-layer restrictions on /wp-admin operations stopped them before they could use it. Defense in depth worked exactly as intended.

Patchstack subsequently observed scanning activity against miniOrange SSO endpoints from six IPs across Belgium, Nigeria, Germany, and the United States. The geographic distribution points to opportunistic sweep traffic rather than targeted reconnaissance. Whoever is running this is not checking which edition or version is installed before throwing the exploit. That is precisely what made the silent-patch situation dangerous.

What to Do Right Now

Find your edition in the table above. Update to the patched version for that edition. Expect a manual plugin upload for cross-line jumps since the WordPress dashboard will not offer a major-line upgrade automatically.

If you cannot update immediately, DigitalOcean published two narrowly-scoped hotfixes. For CVE-2026-61979, add the following immediately after line 246 in Utilities.php:

“php if ( XMLSecurityKey::HMAC_SHA1 === $MG ) { printf( 'HMAC SAML signatures are not supported.' ); exit; } “

For CVE-2026-15981, replace the return at XMLSecurityKey.php:494 with:

“php return openssl_verify( $ql, $hl, $this->key, $MG ) === 1; “

These hotfixes stop the specific exploit paths. They are not a comprehensive fix and should not substitute for the vendor patch. A proper remediation requires an RSA allowlist for signature algorithms and full hardening of the bundled XML security library.

After patching, pull your web server logs and look for authenticated administrator sessions originating from unexpected IPs, especially any from the six scanning addresses published in the Patchstack advisory. That behavioral signal is precisely what surfaced this vulnerability in the first place.

The Structural Problem This Exposes

Vulnerability scanners and databases operate on version ranges mapped to slugs. The model works when a plugin runs one version line. It breaks completely when seven independent editions share one slug and six of them ship patches with no public advisory attached.

Virtual patching does not share this limitation. A firewall rule that blocks the exploit pattern fires against every edition regardless of version number, regardless of whether any public advisory covers that tier. Accurate reporting and accurate protection are different capabilities, and this disclosure is the sharpest illustration of that distinction the WordPress ecosystem has seen this year.

For agencies managing enterprise client sites with SSO configured, this is the checklist item for the week. A scanner showing green means nothing here. Check your edition, check your version, and do the manual upload if needed.

Sources: