WordPress hosts and site operators using miniOrange SAML single sign-on have a fresh patching problem: attackers are now probing two critical authentication-bypass flaws that can be chained to reach the WordPress administrator area.
BleepingComputer reported Monday that exploitation attempts are targeting CVE-2026-61979 and CVE-2026-15981 in the miniOrange SAML 2.0 Single Sign On plugin family. The issue matters for hosting providers because SAML SSO is often deployed on business WordPress sites that rely on identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin rather than local WordPress credentials.
The risk is not limited to the free plugin. Patchstack’s technical write-up, based on work with DigitalOcean’s security team, says the flaws affected multiple paid editions that shared the same WordPress plugin slug but had separate version tracks. Patchstack said the original vendor advisory covered the free edition, while paid customers could miss the urgency because WordPress dashboards may not show the same update warning for commercial builds.
Why hosts should care
The two bugs undermine SAML signature validation. In one path, the plugin accepts a signature algorithm from an incoming SAML response, allowing an attacker to choose HMAC-SHA1 and treat the identity provider’s public key as a shared secret. In the other, an OpenSSL verification error can be handled as a successful result. Chained together, the flaws can let an unauthenticated attacker forge a SAML assertion and obtain a WordPress admin session.
Patchstack said DigitalOcean detected an anomalous WordPress administrator session on August 16 and found that defense-in-depth controls stopped further admin-panel activity. The company’s analysis then traced the bugs and mapped the affected paid versions. Patchstack also reported opportunistic scanning from IP addresses in Europe, Africa, and the United States, with a public proof-of-concept exploit available for the free edition.
What to check now
- Inventory WordPress sites using miniOrange SAML SSO, including paid editions that may not surface standard dashboard update notices.
- Confirm patched versions: free single-site 5.4.5; premium single-site 13.0.4; standard single-site 17.06; premium/enterprise/all-inclusive multisite 20.2.8; enterprise/all-inclusive single-site 26.0.3; VIP single-site 32.0.8; and VIP multisite 35.0.7.
- Review administrator logins and SAML-related access around August 16 onward, especially unexpected sessions from hosting, VPN, or cloud IP ranges.
- Where possible, restrict WordPress admin access by network, add additional admin-session monitoring, and require tested rollback plans before bulk plugin updates across customer sites.
The broader lesson for managed WordPress providers is that commercial plugin channels can create blind spots. A vulnerability fixed in code is not the same as a vulnerability remediated across fleets if paid editions, bundled libraries, and dashboard update signals diverge.
Sources: BleepingComputer; Patchstack.