Emerging Threats

Attackers Exploit miniOrange SAML Flaws to Hijack WordPress Admin Access

Analyst 207||Source: TheHackerNews
WordPress login screen on laptop with blurred office background.

CVE-2026-15981 (CVSS 9.8) allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse with a malformed signature, according to Patchstack and CVE.org.

CVE-2026-15981: malformed signatures can short-circuit verification

Patchstack and CVE.org describe a critical authentication bypass in the Xecurify miniOrange SAML 2.0 Single Sign On plugin. The problem centers on the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(). An OpenSSL error return of -1 is evaluated as truthy and treated as a successful signature verification.

When that happens, an attacker can submit a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error. Verification is bypassed entirely and the plugin calls wp_set_auth_cookie() for the targeted account, effectively logging the attacker in as that WordPress user.

CVE-2026-61979: signature-algorithm confusion enables privilege escalation

Patchstack also flagged a related unauthenticated privilege escalation, CVE-2026-61979 (CVSS 8.1), described as stemming from signature algorithm confusion. That flaw and CVE-2026-15981 together permit unauthenticated actors to obtain administrator sessions when the plugin is present and unpatched.

The vendor issued fixes in the Standard edition: CVE-2026-61979 was addressed in version 17.0.5 and CVE-2026-15981 in version 17.0.6. Site operators running the affected plugin editions are urged to update to those versions.

Observed exploitation and scanning behavior

Patchstack said the vulnerabilities were reported to them by the DigitalOcean security team after that cloud provider observed an anomalous WordPress administrator session attempt originating outside their trusted network. According to Patchstack, the attacker had already used the bypass to obtain a WordPress admin session cookie but was blocked from making changes because administrative operations remained restricted to the trusted network.

Patchstack recorded scanning activity from multiple IP addresses and characterized the spread as opportunistic rather than targeted. The IP addresses listed were:

  • 207.211.214.41
  • 79.127.224.14
  • 102.91.71.83
  • 162.243.116.148
  • 84.201.6.54
  • 64.225.25.188

"The spread suggests opportunistic scanning rather than a targeted campaign," Patchstack wrote, and observers noted the scanner appears to be attempting the exploit broadly without checking which edition or version of the plugin is installed.

Proof-of-concept code and practical risk to site owners

Patchstack warned that proof-of-concept (PoC) code is available that chains the two flaws to obtain administrator privileges and take control of susceptible sites. That public PoC lowers the bar for attackers and increases the risk to unpatched sites running the affected miniOrange SAML plugin.

Because the bypass can result directly in wp_set_auth_cookie() being called for arbitrary accounts, successful exploitation can produce a valid administrator session cookie without credentials. The DigitalOcean disclosure underscores how detection of anomalous admin sessions can reveal exploitation attempts even if subsequent administrative operations are constrained by network restrictions.

What this means for WordPress site owners, cloud providers, and attackers

  • WordPress site owners: apply the vendor fixes immediately — CVE-2026-61979 is fixed in version 17.0.5 (Standard), and CVE-2026-15981 is fixed in version 17.0.6 (Standard). Treat any unexpected administrator session cookies as indicators of compromise and investigate logins originating outside trusted networks.
  • Cloud providers and incident responders: monitor for anomalous administrator session attempts and cross-reference with known scanning IPs; DigitalOcean's detection was the trigger for reporting in this case and shows the value of network-aware session monitoring.
  • Attackers and opportunistic scanners: Patchstack's record of multiple source IPs and the availability of PoC code indicate that scanning to find vulnerable miniOrange SAML installations is already underway; operators should assume opportunistic probes will continue until sites are patched.

The technical root cause — a misinterpreted openssl_verify() return value and algorithm-confusion handling — produced a short, direct path from malformed input to full admin session creation. With fixes available and PoC code public, the immediate action is straightforward: update the plugin versions named by the vendor and investigate any unexplained administrator sessions. The record of opportunistic scanning suggests the window for remediation is narrow.

Original reporting: https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html

Authentication BypassEmerging ThreatsSupply ChainWordpressPlugin VulnerabilitySAMLMiniorangeCVE-2026-15981Xecurify
Related Intelligence

Continue Reading

Law enforcement officers from various countries gather around a table in a briefing room with a large map of West Africa on…

Global Crackdown Targets Cybercrime Networks, Arrests 58

In a major win for global security, an international crackdown on cybercrime networks has led to the arrest of 58 individuals and identification of 263 suspects linked to African crime groups. The operation, which ran from November 2025 to June 2026, targeted notorious cybercrime syndicates like Black Axe, known for large-scale financial fraud and romance scams.

Analyst 207
Crowded gaming center with rows of computers and gamers, one laptop screen blurred and empty in the foreground.

WeedHack Malware Persists, Adapts After Infrastructure Takedown

Even after its infrastructure was taken down, the sneaky WeedHack malware managed to adapt and persist, continuing to infect Minecraft players with its malicious code. McAfee researchers tracked over 6,300 attempts to access the malware in August, showing its resilience as a malware-as-a-service operation.

Analyst 207
Cybersecurity professionals gather around a laptop and whiteboard in a brightly-lit office conference room.

ReliaQuest Exposes ShinyHunters' Social Engineering Tactics

ReliaQuest sets the record straight: claims of a ransomware attack or breach are completely false. The company recently thwarted a social engineering scheme by ShinyHunters, swiftly investigating and publicly rebutting the misinformation.

Analyst 207
Mac laptop on cluttered desk with suspicious Terminal window and Google search results page on screen.

Mac Malware Exploits Fake OpenAI Codex Ads

Beware of fake OpenAI Codex ads: hackers are using Google search results to trick Mac users into downloading malware by pasting a malicious Terminal command. This sneaky tactic unleashes a multi-stage malware infection, putting your device at risk.

Analyst 207