A signature check did run on the forged assertion, and it returned valid [3]. The plugin read SignatureMethod out of the document it was being asked to trust, saw HMAC-SHA1, and switched to a symmetric algorithm on the attacker's instruction [2]. HMAC needs a shared secret, and the key material to hand was the identity provider's RSA public key, so the PEM string was used as one [2]. An IdP publishes that key on purpose [13]. In this configuration, the verification step amounted to asking whether the caller had read the metadata.
The second issue needs even less setup. `openssl_verify()` has three outcomes: 1 for a valid signature, 0 for a mismatch, and -1 when processing fails [4]. The plugin evaluated the result as a boolean, and -1 is truthy in PHP, so a signature malformed enough to break OpenSSL was accepted where a merely wrong one would have been rejected [5]. The output is the same as the first bug: a WordPress authentication cookie for whichever existing user the response named [5].
The inventory problem is arithmetic. The free edition and six paid editions share one plugin slug with unrelated version numbers [9]. The fix versions named in the writeup are 5.4.5 for Free, 13.0.4 for Premium single-site, and 17.0.6 for Standard [10]. A Standard install anywhere between 5.4.5 and 17.0.6 therefore satisfies a "5.4.5 or higher" query and remains exploitable, and the same band exists for Premium up to 13.0.4 [1]. The material also stops after three editions, breaking off at multisite Premium, so four of the seven target versions have to be obtained per edition rather than read off a list [2]. Paid editions may not raise an update notice in the dashboard at all, which makes the fix a file someone uploads by hand [11].
Nothing about the attack is loud on the victim side. There is no password, no MFA approval, and usually no visible sign on screen [14]. What the impersonated administrator may eventually notice is a session created at a time and from an address they did not use [16]. Scans against miniOrange SSO endpoints have been seen from multiple IP regions, which the report characterises as opportunistic and indiscriminate [12], meaning targets are being picked by endpoint rather than by value. The account of the bugs and the incident is credited to Patchstack and DigitalOcean Security, dated 21 August 2026, and rated critical [15].
That combination sets the order of work. The version number on the slug does not tell you the patch state, the dashboard does not tell you an update exists, and the IdP does not tell you a login happened. Three of the signals an operator would normally reach for are absent at once, and the one that remains is the web server log on the WordPress host.
