On this page (7 sections)
Two critical authentication bypasses, both rated CVSS 9.8, were publicly disclosed in July 2026 for the miniOrange SAML 2.0 Single Sign On plugin for WordPress. According to Patchstack, an unauthenticated attacker can forge a SAML assertion and land in /wp-admin as any existing user, including administrators.
The larger problem is visibility. The plugin ships under one WordPress listing but contains seven separate product plans. Patchstack reports that public advisories covered only the free edition, so sites running paid editions may have seen no update prompt and no database warning. If you use this plugin in any edition, check it now.
What happened
Patchstack's write-up credits the DigitalOcean security team with reporting the issue and performing the root cause analysis. DigitalOcean found the gap after its defense-in-depth controls flagged exploitation activity. Patchstack says both bugs were fixed, but the fixes for the six paid editions shipped with no public changelog and no advisory, so no vulnerability database listed them and vulnerable sites were wrongly reported as unaffected.
Patchstack also states that a vulnerable 16.x release has no managed update prompt, meaning the fix must be uploaded manually. This is the single source for these claims, so treat the per-edition details as something to confirm with the vendor.
The two weaknesses in plain terms
CVE-2026-61979: the response chooses its own signature algorithm
Per Patchstack's account of DigitalOcean's analysis (run against Standard edition 16.1.9), the plugin lets the incoming SAML response pick the signature algorithm. If an attacker selects an HMAC-based algorithm, the plugin can use the identity provider's public RSA key as the HMAC secret. A public key is not secret, so anyone who can fetch it from the metadata endpoint can sign their own assertion and have it accepted. This is a classic algorithm confusion flaw. miniOrange fixed it in version 17.0.5 for the Standard edition.
CVE-2026-15981: an error counted as success
PHP's openssl_verify() returns 1 for a valid signature, 0 for invalid and -1 on an internal error. Patchstack reports the plugin checked the result loosely, and in PHP -1 is truthy. A malformed signature that triggers an OpenSSL error can therefore be accepted as valid. The lesson for developers is to compare against the exact success value, not a boolean.
Who is exposed
- Any WordPress site using the miniOrange SAML 2.0 Single Sign On plugin with SAML login enabled, in any of its seven editions.
- Sites on paid editions that relied on the WordPress dashboard or a vulnerability database to tell them they were safe. Patchstack says those sources were incomplete.
- Sites on a 16.x release, which Patchstack says has no managed update prompt.
- Enterprises using SAML for staff access, where a forged administrator login gives full control of the site.
Because the flaw lets an attacker act as any existing user, an exposed site can be fully taken over, including plugin and theme installation, if an administrator account is impersonated.
How to check your exposure
Start by listing the plugin and its installed version. This read-only WP-CLI command, run from your WordPress root, shows the plugin name, status and version. Look for the miniOrange SAML entry and note which edition you run.
wp plugin list --fields=name,status,version,updateDo not rely on the update column alone. Patchstack says paid-edition sites may show no pending update even when vulnerable. Compare your version with the fixed version published by miniOrange for your specific edition. The only fixed version the research confirms is 17.0.5 for the Standard edition. The full per-edition table is in the Patchstack article.
What to do now
0 of 8 done
Detection and monitoring
Patchstack says exploitation has been attempted in the wild and that DigitalOcean blocked the activity on its own infrastructure. Whether other sites were compromised is not stated in the research, so assume nothing either way. Look for new administrator accounts, changed user roles, newly installed plugins and unexpected file changes. Our guides on checking whether a website is hacked and what to do if it is cover next steps.
For ongoing hygiene, the WordPress security checklist and the plugin vulnerability guide explain why a quiet dashboard is not proof of safety, which is exactly what this case shows. A WAF can add a layer, but it does not replace updating the plugin.
The wider lesson
One WordPress slug hiding seven plans with different version numbers broke the usual assumption that a vulnerability database and the update screen tell you the truth. Keep your own inventory of plugins, editions and versions, and verify fixes with the vendor for paid or off-repository components.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.