Hackers Exploit Critical miniOrange SAML Flaws to Hijack WordPress Admin Accounts

Attackers are exploiting two authentication vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that could provide administrator access to vulnerable WordPress websites without passwords.

The flaws affect how the plugin validates Security Assertion Markup Language, or SAML, responses used to connect identity providers with WordPress.

The more critical vulnerability, CVE-2026-15981, carries a CVSS score of 9.8. It occurs because the plugin can interpret an OpenSSL signature-processing error as successful verification. An attacker can exploit that behavior using a crafted SAML response containing the identity of an existing user, including an administrator.

The vulnerability was fixed in version 17.0.6 of the Standard edition.

A second flaw, CVE-2026-61979, has a CVSS score of 8.1 and involves confusion over the signature algorithm used to validate a SAML response. Attackers can reportedly chain the two weaknesses to impersonate users and obtain authenticated WordPress sessions. That issue was addressed in Standard edition version 17.0.5.

Patchstack credited DigitalOcean’s security team with finding the vulnerabilities after it detected an unusual attempt to create a WordPress administrator session from outside a trusted network. The attacker reportedly obtained an administrator cookie, but separate network restrictions prevented access to the management interface.

Justin Beals, CEO and founder of AI-native governance, risk and compliance platform Strike Graph, said the incident exposes broader weaknesses in the plugin ecosystem and software disclosure process.

“The developer patched the flaw but called it a bugfix, not a security fix, so most site owners have no idea they're exposed. Paid and enterprise editions got even less warning, and different version numbering makes it nearly impossible for customers to confirm they're safe.”

Beals said organizations cannot assume software vendors will always communicate security risks clearly.

“If you are not continuously monitoring your own plugin inventory against known CVEs, you are relying entirely on someone else's judgment about what counts as urgent.”

Researchers have recorded scanning from at least six IP addresses, indicating an opportunistic campaign seeking vulnerable installations rather than specific organizations.

Public proof-of-concept code further increases the likelihood of widespread exploitation.

“Any organization using SSO plugins, MiniOrange or otherwise, should be auditing versions now rather than waiting on a vendor advisory that may never come clearly labeled,” Beals said.

WordPress administrators should identify their miniOrange edition and version, install the latest security update and review administrator sessions, accounts and authentication logs for suspicious activity. Restricting access to the WordPress dashboard can provide another defensive layer, but it is not a substitute for patching.