CVE-2026-61979 and CVE-2026-15981 are being chained in live attacks that let an attacker forge SAML responses and obtain WordPress administrator sessions, security researchers report.
The technical chain: how two flaws bypass SAML authentication
The affected component is the miniOrange SAML 2.0 Single Sign On (SSO) plugin for WordPress, which turns a WordPress site into a SAML service provider and lets users authenticate via external identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin. Two distinct flaws observed in exploitation attempts can be combined to bypass authentication.
CVE-2026-61979 arises because the miniOrange plugin accepts the signature algorithm declared in incoming SAML responses instead of enforcing the administrator-configured algorithm. An attacker can force the plugin to select HMAC-SHA1, which causes the plugin to treat the identity provider's RSA public key as if it were a shared HMAC secret. Because that public key is known to the attacker, a forged HMAC signature can be produced and accepted as authentic.
CVE-2026-15981 compounds the problem by causing the plugin to treat an OpenSSL verification error (-1) as a successful verification result, allowing malformed signatures that would normally fail to pass validation.
Observed exploitation: DigitalOcean incident, scanning, and a public PoC
Security firm Patchstack reported active exploitation and opportunistic scanning. On August 16, DigitalOcean blocked an anomalous WordPress administrator session that originated outside its trusted network. Patchstack’s investigation determined attackers chained the two flaws to obtain an admin session cookie through the Standard edition of the plugin running version 16.1.9.
Patchstack’s telemetry shows exploitation attempts and scanning launched from six IP addresses across Europe, Africa, and the United States. A proof-of-concept exploit targeting the free edition is publicly available, and Patchstack warns that the availability of that PoC means the pace of attacks could increase at any time.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPatched releases — and a disclosure gap for paid editions
The two vulnerabilities were publicly disclosed and fixed in July, according to Patchstack. The vendor, Xecurify, produces a family of seven miniOrange plugins: a free edition and six paid editions. The family has a free version with 10,000 downloads and 30,000 customers for the other six editions.
Patchstack says the vendor’s advisory covered only the free edition, leaving paid-edition customers without an explicit alert even though fixes were provided for those paid versions as well. That lack of uniform disclosure reportedly led many sites running paid editions to take no action, creating additional exposure.
- Free, single site – 5.4.5
- Premium, single site – 13.0.4
- Standard, single site – 17.06
- Premium/Enterprise/All-Inclusive, multisite – 20.2.8
- Enterprise/All-Inclusive, single site – 26.0.3
- VIP, single site – 32.0.8
- VIP, multisite – 35.0.7
Patchstack also warns that the WordPress administrator dashboard will not show update warnings for the paid versions of the plugin, so website owners must manually upgrade to a patched release.
What this means for technologists, enterprise procurement leaders, and WordPress site owners
Technologists and security teams: the exploitation chain bypasses signature enforcement and error handling, meaning detection must assume valid-looking credentials can be produced. Patchstack’s findings include an active exploit that produced an administrator session cookie via Standard edition 16.1.9; teams should verify installed plugin editions and manually apply the exact patched releases listed above.
Enterprise procurement and vendor management: the vendor advisory covered only the free edition even though fixes were issued for paid editions, a disclosure gap that left many paid customers unalerted. Procurement and platform owners should confirm whether paid licenses received direct notification and require vendors to notify all affected customers uniformly in future incidents.
WordPress site owners and administrators: because dashboards for paid miniOrange editions will not display update warnings, owners must not rely on in-dashboard prompts and should manually upgrade to the patched versions identified by Patchstack and Xecurify.
After initial access: credential-based risk and the Blue Report 2026
Patchstack notes that overall prevention metrics can mask what happens after an attacker gains valid credentials. “Once attackers are using valid credentials, prevention drops sharply,” the reporting states. The Blue Report 2026 — which measures defenses across 338 million simulations run in customer production environments — is cited to underline that risk profile: credentialed access materially changes an incident’s trajectory.
The immediate facts are clear: two SAML-related flaws, a public PoC, active scanning from multiple continents, and a disclosure gap that left many paid customers unaware. For any WordPress site using miniOrange SAML SSO, the next concrete steps are equally straightforward in the record — verify the installed edition, confirm the version against the list of patched releases, and apply the update manually if needed.
