miniOrange SAML SSO flaws allow WordPress admin hijacking

Critical authentication bypass vulnerabilities have been discovered in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress. These flaws, tracked as CVE-2026-61979 and CVE-2026-15981, allow unauthenticated attackers to forge SAML responses and hijack administrator accounts.

One vulnerability involves signature algorithm confusion, where the plugin accepts an attacker-specified HMAC-SHA1 algorithm and treats a public RSA key as a shared secret. The second flaw stems from improper handling of PHP’s openssl_verify() function; the plugin treats an internal error return value of -1 as a successful verification because -1 evaluates as true in PHP.

Security researchers at DigitalOcean and Patchstack identified active exploitation in the wild, where attackers successfully obtained administrator session cookies. The vulnerabilities affect various editions of the plugin, including Free, Standard, Premium, and Enterprise versions. Users are urged to update to the latest patched versions to secure their WordPress installations.