Recent findings have uncovered that malicious actors are attempting to exploit critical vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin. These vulnerabilities can allow unauthorized individuals to gain access to WordPress accounts, including those with administrative privileges. The security flaws were disclosed by Patchstack, highlighting the potential risk to WordPress users.
Details of the Vulnerabilities
The flaws identified are serious authentication bypass issues, specifically CVE-2026-61979 and CVE-2026-15981. The first flaw, CVE-2026-61979, scores an 8.1 on the CVSS scale and involves privilege escalation due to confusion in the signature algorithm. This issue has been addressed in version 17.0.5 of the plugin’s Standard edition.
More severe is CVE-2026-15981, which holds a CVSS score of 9.8. This vulnerability occurs when malformed signatures are incorrectly verified as valid. The problem arises from the mo_saml_validate_signature() function’s improper handling of the return value from PHP’s openssl_verify(), where an error is mistakenly treated as a successful verification. The fix for this was released in version 17.0.6 of the plugin.
Potential Impact and Exploitation
The vulnerabilities allow attackers to craft SAML responses with manipulated signatures that the plugin accepts as legitimate. This can lead to unauthorized logins under any existing WordPress user accounts, including administrators. The exploit involves sending a crafted SAMLResponse with an attacker-controlled NameID and a malformed signature to bypass verification processes.
DigitalOcean’s security team was instrumental in identifying these issues following suspicious activity from an unfamiliar network accessing a WordPress admin session. Although the attackers managed to acquire a session cookie, further progress was hindered by network restrictions on the admin panel operations.
Preventive Measures and Recommendations
Security experts emphasize the importance for WordPress site owners to implement the latest updates to mitigate these vulnerabilities. The widespread scanning activity, recorded from multiple IP addresses, suggests non-targeted attempts to exploit any site with the vulnerable plugin, irrespective of its version or edition.
Patchstack has noted that these scanning efforts appear to be opportunistic, with attackers indiscriminately targeting any vulnerable installation. Given the availability of a proof-of-concept code, the urgency for site administrators to apply security patches cannot be overstated. Ensuring these fixes will safeguard against potential exploitation and unauthorized access.
In conclusion, WordPress users utilizing the miniOrange SAML 2.0 plugin should prioritize updating to the latest versions to protect their sites from these critical vulnerabilities and potential administrative breaches.
