Hackers Exploit miniOrange WordPress Plugin to Hijack Admin Accounts

Two authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin (CVE-2026-61979 and CVE-2026-15981) are being actively exploited in the wild, according to BleepingComputer. The plugin, built by Xecurify, lets WordPress sites use enterprise identity providers — but the flaws allow attackers to forge the cryptographic signatures that those identity checks rely on. The end result: an attacker with no credentials can log into a WordPress site as a full administrator.

The first bug lets an attacker force the plugin to use HMAC-SHA1 with the identity provider’s public key as the shared secret — since that key is public, anyone can produce a signature that the plugin will accept. The second flaw causes the plugin to treat an OpenSSL verification error as a successful result, so even a malformed or garbage signature passes. Attacks have been tracked from six IP addresses across Europe, Africa, and the United States, and public proof-of-concept code exists for the free edition. An incident at DigitalOcean on August 16 — where an anomalous admin session was traced to attackers running an unpatched plugin version — shows exploitation is not theoretical. A complicating factor: paid plugin editions don’t show update alerts inside the WordPress dashboard, so many site owners may not know they need to patch.

How to check if you’re affected

Affected versions of the miniOrange SAML 2.0 Single Sign On plugin include all editions below the patched releases. Update to the following versions or later:

Go to Plugins → Installed Plugins in your WordPress dashboard, search for “miniOrange SAML,” and compare your version against this table. If you are on a paid tier, check the miniOrange portal directly — dashboard notifications may be absent.

Sources

• BleepingComputer — Hackers target WordPress sites in miniOrange auth bypass attacks