miniOrange SAML SSO Bypass Vulnerability
A miniOrange SAML SSO bypass is under active exploitation against WordPress sites, and most vulnerability scanners cannot detect whether a given site is actually affected. Two chained authentication bugs, CVE-2026-61979 and CVE-2026-15981 (CVSS 9.8 each), let an unauthenticated attacker forge a SAML login and access wp-admin as any existing user, including administrators. DigitalOcean confirmed exploitation attempts starting August 16, 2026, against a paid plugin edition that every public vulnerability database reported as already patched.
What Happened
This miniOrange SAML SSO bypass lives in the miniOrange SAML 2.0 Single Sign On plugin, which turns a WordPress site into a SAML service provider, letting staff authenticate through Microsoft Entra ID, Okta, Google Workspace, or OneLogin instead of separate WordPress credentials. CVE-2026-61979 is a signature-algorithm confusion bug: the plugin lets an incoming SAML response specify its own signature algorithm, including HMAC-SHA1, which causes the plugin to treat the identity provider’s public RSA key as if it were a shared secret. Since that key is public by definition, an attacker can forge a signature the plugin accepts as genuine. CVE-2026-15981 is a separate flaw in how the plugin handles OpenSSL’s tri-state verification result: an internal OpenSSL error (-1) is evaluated as a boolean, and PHP treats -1 as true, so malformed signatures pass validation.
Both bugs were publicly disclosed and fixed for the plugin’s free edition in July 2026. What was not disclosed: miniOrange ships this plugin under a single WordPress.org listing that actually bundles seven independently versioned product editions (Free, Premium, Standard, Enterprise/All-Inclusive, and VIP, each in single-site and multisite variants), and only the free edition ever received a public security advisory. The DigitalOcean security team detected and blocked an anomalous WordPress admin session on August 16, traced it to the Standard edition running version 16.1.9, and — finding no existing public analysis for any paid edition — performed its own root-cause analysis and worked with the vendor to obtain the complete seven-edition version table, subsequently published by security firm Patchstack.
Because every public vulnerability record only ever described the free edition’s version range, every paid installation running a higher version number was reported as already patched, regardless of whether it actually was. A proof-of-concept exploit for the free edition is now public, and Patchstack has observed opportunistic scanning from at least six IP addresses across Europe, Africa, and the United States.
Why It Matters
WordPress paired with SSO through a corporate identity provider is a common setup for DACH Mittelstand marketing sites, intranets, and partner portals tied into Entra ID or Google Workspace. This miniOrange SAML SSO bypass is not a story about a missed patch window — it is a story about a vendor disclosure practice that made accurate patch verification structurally impossible for the majority of the plugin’s customer base. Any compliance process that relies on scanner output or CVE version ranges as proof of remediation needs a way to catch exactly this failure mode: a vendor that patches quietly, without a changelog entry or advisory covering every product line it sells.
What You Should Do Now
- Immediate: identify your exact miniOrange SAML SSO edition (Free, Premium, Standard, Enterprise/All-Inclusive, or VIP, single-site or multisite) and compare your installed version against the published seven-edition version table from Patchstack and DigitalOcean.
- Verify: do not trust your plugin update dashboard alone — paid editions on a vulnerable version will not show an available update through the normal WordPress mechanism; a manual plugin upload to the patched build is required.
- Mitigate: if you cannot update immediately, apply DigitalOcean’s narrowly scoped code-level hotfixes (published in the Patchstack write-up) to block the exploitable signature paths without waiting for the vendor build.
- Monitor: audit administrator login logs for sessions originating from IP ranges outside your organization’s expected footprint — this is the exact signal that surfaced the exploitation in the first place, and it does not depend on knowing your plugin version.
DIESEC Perspective
The lesson here generalizes beyond this one plugin: a vulnerability database record assumes every version number under a single product listing climbs in one direction. When a vendor bundles multiple independently versioned product lines under one listing and only documents one of them, every downstream signal built on that record — scanners, dashboards, compliance reports — goes blind for the undocumented lines at the same time. Verifying “we are patched” needs to check the vendor’s actual shipped build against your specific edition, not just whether a CVE has a fix in principle.
Not sure whether your WordPress SSO setup has this exposure, or which miniOrange edition you are actually running? Contact DIESEC for a rapid WordPress plugin and SSO configuration review.
Sources: Patchstack | BleepingComputer
Published: 2026-08-28 | Category: Vulnerabilities & Patches | ~5 min read
