TWO critical authentication bypass flaws in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress have been exploited in the wild before any vulnerability database flagged the paid editions as at risk. The weaknesses, tracked as CVE-2026-15981 and CVE-2026-61979, allow unauthenticated attackers to forge valid SAML responses and log in as any WordPress user, including administrators. SecurityAffairs covered the active exploitation here, while Patchstack provided the technical breakdown here.
Both vulnerabilities received a CVSS score of 9.8, reflecting their ease of exploitation and high impact. The core problem lies in the plugin’s insufficient verification of the SAML signature, which lets an attacker alter the NameID or email attribute in the assertion to impersonate a chosen account. SecurityWeek noted that the free version and all paid editions prior to the latest build are affected here. No user interaction is required; a malicious actor simply sends a crafted SAML payload to the WordPress endpoint.
The free flavour of the plugin, reported to be active on more than ten thousand websites, has since been updated, but users of the commercial SKUs were not warned because the version numbers used by those editions diverge from the public changelog. Consequently administrators may see a higher version label and assume the build is safe, while the underlying code remains vulnerable. DigitalOcean first noticed the abuse through unexpected administrator login spikes that did not trigger traditional alerts.
No specific threat‑actor group has been linked to the campaign, and the activity appears opportunistic rather than targeted. The absence of an entry in common vulnerability repositories meant that scanners and patch‑management tools did not raise flags, leaving many site owners unaware of the danger. This gap highlights how inconsistent versioning between free and paid products can create a false sense of security.
The episode shows why relying solely on public vulnerability feeds can be risky when vendors maintain separate numbering schemes for free and paid products. It also stresses the need for clear, timely advisories that cover all affected builds, regardless of licensing model. Organizations should treat any plugin update notice as potentially relevant to every edition they have deployed.
Defenders should first confirm which release of the miniOrange SAML SSO plugin is running on each WordPress instance and compare it against the patched version referenced in the vendor’s advisory. If an update is not immediately available, the safest interim step is to disable SAML‑based login and fall back to native WordPress authentication while enforcing strong passwords. Simultaneously, review authentication logs for any administrator sessions originating from unfamiliar IP addresses or occurring at odd hours, and consider resetting privileged passwords as a precaution.
Additional measures include deploying a web‑application firewall rule that blocks malformed SAML assertions, subscribing to the plugin’s security mailing list for future notices, and maintaining an up‑to‑date inventory of all commercial extensions alongside their free counterparts. Regular vulnerability scans that inspect internal version numbers can help catch similar oversights before they are exploited in the wild.