MiniOrange SAML SSO Plugin Vulnerabilities Allow Unauthenticated Admin Access

Two critical authentication bypass vulnerabilities, CVE-2026-61979 and CVE-2026-15981, have been discovered in the widely-used miniOrange SAML 2.0 Single Sign On plugin for WordPress. These flaws, rated with a CVSS score of 9.8, enable unauthenticated attackers to forge Security Assertion Markup Language (SAML) assertions, effectively allowing them to log in as any user on a vulnerable WordPress site, including administrators. The vulnerabilities were fixed by miniOrange, but a significant coverage gap existed because public advisories and vulnerability databases only covered the free edition of the plugin, leaving users of six paid editions unaware of their exposure.

The first vulnerability, CVE-2026-61979, stems from a signature algorithm confusion. The plugin incorrectly allows incoming SAML responses to specify their own signature algorithm. Attackers can exploit this by setting the SignatureMethod to HMAC-SHA1 and then using the Identity Provider's (IdP) public RSA key as the HMAC secret. Since the public key is inherently public, this allows an attacker to sign their own assertion, which the plugin then verifies as legitimate. This flaw was addressed in version 17.0.5 of the Standard edition.

The second critical flaw, CVE-2026-15981, involves the mishandling of OpenSSL errors. The openssl_verify() function in PHP returns 1 for a valid signature, 0 for an invalid one, and -1 when an internal OpenSSL error occurs. The miniOrange plugin incorrectly treated the -1 return value (which is truthy in PHP boolean contexts) as a successful verification. This means a malformed signature that triggers an OpenSSL error would be accepted as valid, allowing an attacker to bypass authentication.

These vulnerabilities were discovered by the DigitalOcean security team, who noted that the plugin is distributed under a single WordPress slug but encompasses seven distinct, independently versioned product editions. Public security advisories and vulnerability databases predominantly focused on the free edition, leaving the six paid editions with no public advisories or versioning information. This created a situation where many sites, including enterprise customers, were unaware of their vulnerability and did not receive update prompts through the standard WordPress dashboard.

Exploitation attempts for these vulnerabilities have been observed in the wild. DigitalOcean's security infrastructure detected and blocked such activity, sharing indicators of compromise to aid in broader ecosystem defense. The lack of clear versioning and advisories for the paid editions meant that vulnerable sites were often incorrectly reported as unaffected by security scanners and databases.

miniOrange has since released patches for the affected editions. For the Standard edition, CVE-2026-61979 was fixed in version 17.0.5, and CVE-2026-15981 was fixed in version 17.0.6. Users are strongly advised to update their miniOrange SAML 2.0 Single Sign On plugin to the latest patched version corresponding to their specific edition. A table detailing the editions, their vulnerable versions, and patch versions is available to help administrators identify their exposure.

In addition to these two critical flaws, a third, less severe issue requiring administrative interaction was also disclosed. While not as critical as the authentication bypasses, it is recommended that administrators also patch this vulnerability to ensure comprehensive security. The incident highlights the critical importance of thorough vulnerability management, especially for plugins with complex licensing or distribution models that can obscure security coverage.