Attackers are targeting two serious flaws in the miniOrange SAML plugin for WordPress. If exploited, the flaws could let an attacker sign in as another WordPress user, including an administrator.

The issues affect the Xecurify miniOrange SAML 2.0 Single Sign On plugin. They are tracked as CVE-2026-61979 and CVE-2026-15981.

Since an attacker does not need to log in first, WordPress site owners should check their plugin versions as soon as possible.

Two miniOrange SAML Flaws

CVE-2026-61979 has a CVSS score of 8.1. The flaw involves signature verification and can lead to privilege escalation.

Meanwhile, CVE-2026-15981 has a CVSS score of 9.8. This issue can cause an invalid signature to be treated as valid.

As a result, an attacker can create a malicious SAML response. The plugin may then give access to the targeted WordPress user.

In the worst case, the attacker could gain administrator access without knowing the account password.

Attack Activity Has Been Seen

Patchstack has recorded scanning activity from several IP addresses. The pattern suggests that attackers are searching widely for websites that use the plugin.

In addition, public proof-of-concept code is now available. Therefore, websites that remain unpatched face a higher risk.

DigitalOcean discovered the issue after detecting an unusual WordPress administrator session attempt from outside its trusted network. In that case, the attacker had already obtained an admin session cookie.

Fixed Versions

For the Standard Edition, CVE-2026-61979 was fixed in version 17.0.5.

CVE-2026-15981 was then fixed in version 17.0.6.

Therefore, users should install the latest available release. Updating only to version 17.0.5 is not enough to address both flaws.

What Should Site Owners Do?

First, update the miniOrange SAML plugin to the latest version.

Next, review WordPress administrator accounts and active sessions. If anything looks unfamiliar, reset passwords and end suspicious sessions.

Also, check WordPress and web server logs for unusual login activity. If the site previously used a vulnerable version, perform an additional security review for unknown users or plugins.

Key Takeaway

The miniOrange SAML flaws show how a weakness in Single Sign-On can directly affect WordPress security.

CVE-2026-15981 can even allow an attacker to access an administrator account without the password. Since exploit code is public and scanning activity has already been seen, site owners should update quickly.

In the end, fast patching and login monitoring are the most important steps to reduce the risk.

Source: https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html