Published · 12h agoSecurity2 min read
Patchstack says attackers are chaining CVE-2026-61979 and CVE-2026-15981 to mint WordPress admin sessions. Only the free edition got an advisory; Standard needs 17.0.6.
Not a builder's beat, but builders have a standing stake in it.See today for builders
Compiled by The WatchSomething wrong?How this is made
The cheap half of this is CVE-2026-15981. PHP's openssl_verify() returns a tri-state integer, and miniOrange's mo_saml_validate_signature() ran a loose boolean check against it, so the -1 that means OpenSSL errored read as truthy and was treated as a successful verification [4]. An attacker submits a SAMLResponse carrying the NameID of the account they want plus a signature malformed badly enough to break OpenSSL, and the plugin calls wp_set_auth_cookie() for that account [5]. No credentials are involved and the real identity provider never sees the request.
The other half, CVE-2026-61979, is the older SAML mistake. According to BleepingComputer's account of Patchstack's analysis, the plugin accepts the signature algorithm named in the incoming response rather than enforcing the configured one, so an attacker can nominate HMAC-SHA1 and the plugin then treats the identity provider's RSA public key as the shared secret [6]. That key is published by design, which is what makes the forgery trivial [6].
The population numbers are where this gets awkward. SecurityWeek puts the free edition on more than 10,000 sites and notes that usage figures for the paid and enterprise editions are not published [17]. BleepingComputer counts 30,000 customers across the other six editions [18], roughly three times the installed base that received an advisory at all [23]. Those six were patched in July alongside the free edition and got no alert [15], and they do not share a version line: 13.0.4 for single-site Premium, 20.2.8 for the multisite bundles, 26.0.3 for Enterprise, 32.0.8 and 35.0.7 for VIP [19]. Standard is worse than a naming problem. The 8.1 was closed in 17.0.5 and the 9.8 in 17.0.6 [2][3], so a site that took the first fix and stopped is still open to the more serious one [24].
Patchstack credits DigitalOcean's security team, which found the bugs after an anomalous WordPress administrator session attempt arrived from outside its trusted network on 16 August [7][9]. The attacker already held a valid admin session cookie, obtained by chaining the two flaws through Standard edition 16.1.9 [10], and was stalled only because admin panel operations sat restricted behind that trusted network [8]. Nothing in the plugin stopped them; a network boundary in front of wp-admin did.
Patchstack's read of the scanning is that it is opportunistic, with the exploit thrown at every site carrying the plugin without checking which edition or version is behind it [13]. Running a paid tier therefore buys no obscurity. SecurityWeek says it approached the developer for comment and would update if it responded [22].
Ranked by verification strength, evidence, and original report placement.
Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators.
CVE-2026-61979 (CVSS 8.1) is an unauthenticated privilege escalation vulnerability stemming from signature algorithm confusion, fixed in version 17.0.5 for the Standard edition.
CVE-2026-15981 (CVSS 9.8) is an authentication bypass vulnerability stemming from accepting malformed signatures as valid, fixed in version 17.0.6 for the Standard edition.
Per the CVE.org description of CVE-2026-15981, mo_saml_validate_signature() performs a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification.
Unauthenticated attackers can log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error, bypassing verification and resulting in wp_set_auth_cookie() being called for the targeted account.
Because the miniOrange SAML SSO plugin accepts the signature algorithm from incoming SAML responses instead of enforcing the configured one, an attacker can use CVE-2026-61979 to select HMAC-SHA1, causing the plugin to treat the identity provider's RSA public key as the shared secret; since the public key is known, the attacker can forge a signature the plugin accepts as authentic.
The reporting this story was synthesized from, earliest first. Every link goes to the original.
