Full research report

Hackers target WordPress sites in miniOrange auth bypass attacks

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

The strongest evidence supports two substantive weaknesses: signature-algorithm confusion, represented by duplicate identifiers CVE-2026-15013 and CVE-2026-61979, and the OpenSSL error-handling flaw CVE-2026-15981. Both sit in the plugin's SAML signature-validation path and can lead directly from unauthenticated web access to administrator impersonation. Patchstack's known-exploited designation raises the issue above theoretical severity, although public evidence does not yet establish campaign scale, actor identity or post-compromise tooling. Version 5.4.4 addresses the earlier signature issue in the free plugin, but 5.4.5 or later is necessary to cover CVE-2026-15981 as well. Commercial-edition operators should verify their exact fixed release with miniOrange rather than applying the free-edition version number.

What happened

The signature-algorithm issue was publicly recorded as CVE-2026-15013 on 15 July 2026, while CVE-2026-15981 was published on 23 July; CVE-2026-61979, which Patchstack identifies as duplicating CVE-2026-15013, followed on 13 August. Reporting on 24 August described attempts to use the flaws against WordPress sites, while Patchstack now marks CVE-2026-61979 as known exploited. The available evidence establishes a current exploitation risk but does not identify an actor or campaign.

Affected scope

The public WordPress plugin SAML Single Sign On – SSO Login is affected through 5.4.3 by the signature-algorithm/privilege-escalation issue and through 5.4.4 by CVE-2026-15981; version 5.4.5 or later is required to address both in the free edition. Reporting also says commercial miniOrange editions were affected, but their complete version-specific fix matrix was not independently confirmed from an accessible vendor advisory.

Technical assessment

One weakness allows an attacker-controlled Security Assertion Markup Language (SAML) response to influence the signature algorithm, enabling an identity-provider public key to be handled as a shared secret; CVE-2026-15013 describes this mechanism and Patchstack says CVE-2026-61979 is its duplicate. CVE-2026-15981 separately treats an OpenSSL verification error as a successful result because of an unsafe truth-value check. Both weaknesses undermine the SAML trust boundary and can permit an unauthenticated attacker to impersonate an existing WordPress administrator without compromising the legitimate identity provider.

Recommended defensive actions

  1. update the free miniOrange SAML Single Sign On plugin to version 5.4.5 or later, which covers both documented weaknesses
  2. verify the installed edition and obtain the corresponding fixed commercial build directly from miniOrange where the site uses a paid or multisite edition
  3. audit WordPress and identity-provider authentication records for unexpected SAML administrator sessions, unfamiliar source addresses and logins outside normal administrative patterns
  4. review administrator accounts, recently installed plugins, theme or configuration changes and newly created persistence mechanisms on exposed installations
  5. revoke active WordPress sessions and reset affected administrator credentials if suspicious SAML authentication is found
  6. restrict administrative access and the SAML assertion consumer surface with network or application controls where business requirements permit

Uncertainties and evidence gaps

  • No actor, malware family or coherent campaign has been attributed in the verified records.
  • The reported 16 August incident and the number of attempted or successful compromises were not independently corroborated by a second incident-specific source.
  • Patchstack calls CVE-2026-15013 a duplicate of CVE-2026-61979, but public records retain both identifiers and present different severity descriptions.
  • A complete vendor-published fix matrix for all paid, enterprise, VIP and multisite editions was not located.
  • No standalone public proof-of-concept or exploit repository was found during the focused searches.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access to a WordPress site's miniOrange SAML single sign-on handling is sufficient according to the vulnerability records.
ComponentThe plugin's SAML response and cryptographic-signature validation boundary between WordPress and the configured identity provider.
MechanismAttacker-controlled signature-algorithm selection or incorrect acceptance of an OpenSSL verification error can cause an untrusted SAML assertion to be treated as valid.
ImpactImpersonation of an existing WordPress user, including an administrator, followed by administrative site control.
DetectionUnexpected SAML-backed administrator logins, WordPress authentication cookies issued from unfamiliar addresses, anomalous administrative sessions, new privileged users or unplanned plugin and configuration changes.
MitigationUpdate the free edition to 5.4.5 or later; verify and install the appropriate vendor-fixed build for each commercial or multisite edition.
Exploitation status

Confirmed exploitation attempts are reported against vulnerable miniOrange installations, and Patchstack marks CVE-2026-61979 as known exploited; no standalone public PoC was located.

Research process

The investigation began by separating the reported August exploitation activity from the vulnerabilities' July and August disclosure records. NVD, Patchstack and Wordfence independently confirm the affected component, unauthenticated administrative impact and free-edition fixes; Patchstack additionally marks CVE-2026-61979 as exploited and identifies CVE-2026-15013 as a duplicate. The conclusion is that defenders should treat exposed installations as an urgent account-takeover risk, while attribution, campaign scale and commercial-edition version coverage remain unresolved.

  1. What exactly did the supplied report claim?
    Opened the supplied BleepingComputer article URL before using it as a lead.
    bleepingcomputer.com ↗

    The site returned a security-verification page rather than independently inspectable article content.

    why The supplied article text was therefore treated as untrusted reporting and not used as the sole authority for technical or remediation claims.

  2. Is CVE-2026-61979 a real record tied to the miniOrange plugin?
    Reviewed the National Vulnerability Database entry.
    nvd.nist.gov ↗

    NVD describes unauthenticated privilege escalation in SAML SP Single Sign On through version 5.4.3 and identifies Patchstack as the assigning authority.

    why This independently confirmed the CVE-to-product relationship and unauthenticated impact.

  3. What is the independently recorded mechanism and scope of CVE-2026-15981?
    Reviewed its National Vulnerability Database entry.
    nvd.nist.gov ↗

    The entry states that versions through 5.4.4 can accept an OpenSSL error return as successful signature verification, allowing impersonation of existing users including administrators.

    why This established that CVE-2026-15981 is a distinct authentication bypass and supplied a source-backed technical mechanism.

  4. Is exploitation recognised, and how does CVE-2026-61979 relate to the earlier signature-confusion identifier?
    Reviewed Patchstack's vulnerability record.
    patchstack.com ↗

    Patchstack marks the flaw as known exploited, gives 5.4.4 as the fix for this issue and says CVE-2026-15013 duplicates CVE-2026-61979.

    why This supports a current exploitation assessment while preventing the duplicate identifier from being misrepresented as a third independent attack primitive.

  5. Which release fully fixes CVE-2026-15981 in the free plugin?
    Reviewed Wordfence's detailed CVE-2026-15981 record.

    Wordfence lists versions through 5.4.4 as affected and version 5.4.5 as patched.

    why Because 5.4.4 only addresses the earlier issue, defenders need 5.4.5 or later to cover both flaws in the free edition.

  6. Does a separate source confirm CVE-2026-61979's impact and fix?
    Reviewed Wordfence's CVE-2026-61979 record.

    Wordfence records unauthenticated elevation to administrator through version 5.4.3 and remediation in 5.4.4 or later.

    why This corroborated the affected range and administrator-level impact on a domain independent of Patchstack and NVD.

  7. What mechanism lies behind the duplicate signature-confusion record?
    Reviewed Wordfence's CVE-2026-15013 technical record.
    wordfence.com ↗

    The plugin accepts an algorithm choice from an untrusted SAML response and can handle the identity provider's public key as an HMAC secret, enabling forged assertions to pass validation.

    why This explains the cryptographic trust failure without assuming that CVE-2026-61979 and CVE-2026-15013 represent separate vulnerabilities.

Named in this story
TargetsWordPress sites using the miniOrange SAML Single Sign On – SSO Login pluginAdministrators of internet-accessible WordPress installations using SAML single sign-on
Related CVEs CVE-2026-15981CVE-2026-61979CVE-2026-15013

Research coverage

All 67 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 67 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok9 records Primary evidence1 matched items Published the source report used to frame and date the event.
NVDcve ok900 records Primary evidence2 matched items Supplied a vendor or government advisory opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1675 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5332 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1012 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok8 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 14 opened outside the registered collection
References & evidence
Vendor & gov advisories3
NVD: CVE-2026-61979 nvd.nist.gov ↗

Confirms unauthenticated privilege escalation in SAML SP Single Sign On through version 5.4.3.

NVD: CVE-2026-15981 nvd.nist.gov ↗

Documents the OpenSSL verification error handling flaw affecting versions through 5.4.4.

Patchstack: SAML SP Single Sign On privilege escalation patchstack.com ↗

Marks CVE-2026-61979 as known exploited, identifies 5.4.4 as its free-edition fix and records CVE-2026-15013 as a duplicate.

Analysis & research1
Wordfence: CVE-2026-15013 signature algorithm confusion wordfence.com ↗

Provides the technical description associated with the signature-algorithm flaw that Patchstack identifies as a duplicate of CVE-2026-61979.