Loading today’s stories
Security5 distinct publishers2 min readPublished
Patchstack says attackers are chaining CVE-2026-61979 and CVE-2026-15981 to mint WordPress admin sessions. Only the free edition got an advisory; Standard needs 17.0.6.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The cheap half of this is CVE-2026-15981. PHP's openssl_verify() returns a tri-state integer, and miniOrange's mo_saml_validate_signature() ran a loose boolean check against it, so the -1 that means OpenSSL errored read as truthy and was treated as a successful verification [4]. An attacker submits a SAMLResponse carrying the NameID of the account they want plus a signature malformed badly enough to break OpenSSL, and the plugin calls wp_set_auth_cookie() for that account [5]. No credentials are involved and the real identity provider never sees the request.
The other half, CVE-2026-61979, is the older SAML mistake. According to BleepingComputer's account of Patchstack's analysis, the plugin accepts the signature algorithm named in the incoming response rather than enforcing the configured one, so an attacker can nominate HMAC-SHA1 and the plugin then treats the identity provider's RSA public key as the shared secret [6]. That key is published by design, which is what makes the forgery trivial [6].
The population numbers are where this gets awkward. SecurityWeek puts the free edition on more than 10,000 sites and notes that usage figures for the paid and enterprise editions are not published [17]. BleepingComputer counts 30,000 customers across the other six editions [18], roughly three times the installed base that received an advisory at all [23]. Those six were patched in July alongside the free edition and got no alert [15], and they do not share a version line: 13.0.4 for single-site Premium, 20.2.8 for the multisite bundles, 26.0.3 for Enterprise, 32.0.8 and 35.0.7 for VIP [19]. Standard is worse than a naming problem. The 8.1 was closed in 17.0.5 and the 9.8 in 17.0.6 [2][3], so a site that took the first fix and stopped is still open to the more serious one [24].
Patchstack credits DigitalOcean's security team, which found the bugs after an anomalous WordPress administrator session attempt arrived from outside its trusted network on 16 August [7][9]. The attacker already held a valid admin session cookie, obtained by chaining the two flaws through Standard edition 16.1.9 [10], and was stalled only because admin panel operations sat restricted behind that trusted network [8]. Nothing in the plugin stopped them; a network boundary in front of wp-admin did.
Patchstack's read of the scanning is that it is opportunistic, with the exploit thrown at every site carrying the plugin without checking which edition or version is behind it [13]. Running a paid tier therefore buys no obscurity. SecurityWeek says it approached the developer for comment and would update if it responded [22].
Ranked by verification strength, evidence, and original report placement.
Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators.
CVE-2026-61979 (CVSS 8.1) is an unauthenticated privilege escalation vulnerability stemming from signature algorithm confusion, fixed in version 17.0.5 for the Standard edition.
CVE-2026-15981 (CVSS 9.8) is an authentication bypass vulnerability stemming from accepting malformed signatures as valid, fixed in version 17.0.6 for the Standard edition.
Per the CVE.org description of CVE-2026-15981, mo_saml_validate_signature() performs a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification.
Unauthenticated attackers can log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error, bypassing verification and resulting in wp_set_auth_cookie() being called for the targeted account.
Because the miniOrange SAML SSO plugin accepts the signature algorithm from incoming SAML responses instead of enforcing the configured one, an attacker can use CVE-2026-61979 to select HMAC-SHA1, causing the plugin to treat the identity provider's RSA public key as the shared secret; since the public key is known, the attacker can forge a signature the plugin accepts as authentic.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Named CVEs, code-level root cause and a documented intrusion, all tracing to one research source
The technical core is unusually well specified for an in-the-wild plugin story: two CVE identifiers with CVSS scores, the CVE.org description naming the vulnerable function and the openssl_verify() tri-state misuse, a full fixed-version matrix, six attacker IPs, and a dated incident at a named cloud provider. Three independent outlets carry it and a fourth reproduces it. The ceiling comes from single-origin research: every substantive detail derives from Patchstack's disclosure with DigitalOcean, the vendor has not commented, and the publishers disagree on the Standard-edition fix version.
Exposure quantified at both tiers; remediation uptake unmeasured
Deployment scale is disclosed on both sides of the advisory gap: 10,000-plus free installs and roughly 30,000 paid customers across six editions, with the plugin acting as the SAML service provider for enterprise IdPs such as Entra ID and Okta. Attacker-side adoption is also observed, with scanning from six IPs and a public PoC. What is missing is how many sites have actually taken the July fixes; no source offers patch-uptake telemetry, and paid-edition usage statistics are explicitly unavailable, so the exposed population cannot be sized precisely.
Slightly understated, mainly on the paid-edition exposure
Language across the cluster stays close to what the evidence supports: exploitation is described as opportunistic scanning rather than a targeted campaign, and the one documented intrusion is reported as having stalled at network controls rather than escalating to full site takeover. If anything the practical risk is under-communicated rather than inflated: the larger paid population was never alerted, the dashboard shows them no prompt, and the Standard 17.0.5-versus-17.0.6 distinction is easy to miss in the coverage, so a reader could plausibly conclude a partially patched site is safe.
Single security-vendor research origin, silent vendor, one promotional insert
All disclosure, telemetry, severity framing and quotes originate with Patchstack, a commercial WordPress security firm whose product addresses precisely this class of unpatched-plugin risk, with reporting credit shared with DigitalOcean's security team. The plugin vendor is absent from the record and did not answer SecurityWeek's request for comment, so no counterweight exists. The originating article also closes with a promotional block for an unrelated commercial security report, and one downstream item is a derivative brief rather than independent verification. None of this contradicts the technical findings, which are corroborated by a public CVE description, but the story's shape is set by one interested party.
High confidence in the technical facts, lower on exposed-population sizing
The vulnerability mechanics, severity ratings, exploitation activity and disclosure gap are consistently reported across three independent publishers and corroborated by a public CVE description, supporting firm conclusions. Confidence is held back by the unresolved Standard-edition version discrepancy, absent paid-edition usage data, no vendor statement, and no measurement of how much of the install base remains unpatched.
build
One slug, seven editions: the miniOrange SAML bug that makes published metadata an admin login1 distinct publisher
security
GiveWP issues accounts to unauthenticated attackers on sites where registration is off3 distinct publishers
build
Forminator trusts a forged upload: a dropdown flaw exposes 600,000 WordPress sites to RCE1 distinct publisher
leadership
CrowdStrike buys SGNL, and standing privilege becomes a line item you have to defend1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
bleepingcomputer.com
1 article · August 24, 2026
scworld.com
1 article · August 24, 2026
securityaffairs.com
1 article · August 25, 2026
securityweek.com
1 article · August 25, 2026
thehackernews.com
2 articles · August 25, 2026