Two unauthenticated flaws in a popular WordPress SAML plugin let attackers sign in as any user, including administrators, with a single crafted request.
Patchstack disclosed the bugs in the Xecurify miniOrange SAML 2.0 Single Sign On plugin. The more severe, CVE-2026-15981 (CVSS 9.8), is an authentication bypass that accepts malformed signatures as valid. The plugin’s validation function performs a loose boolean check on the integer returned by PHP’s openssl_verify(), so an error value of -1 is treated as a successful verification. An attacker submits a crafted SAMLResponse with a chosen NameID and a broken signature, and WordPress logs the victim in without any credentials.
The second issue, CVE-2026-61979 (CVSS 8.1), stems from signature algorithm confusion and enables unauthenticated privilege escalation.
DigitalOcean’s security team found the flaws after spotting an anomalous WordPress admin session attempt from outside its trusted network. The intruder had already grabbed an admin session cookie via the bypass, but stalled because panel operations sat behind the network boundary. Scanning activity has been recorded from a handful of IP addresses, and Patchstack warns that exploitation is already underway.
Fixes ship in plugin versions 17.0.5 and 17.0.6 for the Standard edition. Sites still on older builds should update immediately, and admins should audit user accounts for unexpected additions.
