Silent Patch Hazard: Critical MiniOrange SAML SSO Flaws (CVE-2026-61979 & CVE-2026-15981) Exploited in Wild
Executive Summary
Threat actors have launched opportunistic, mass-exploitation campaigns targeting two critical authentication bypass vulnerabilities—tracked as CVE-2026-61979 and CVE-2026-15981, both carrying critical CVSS 9.8 ratings—in the MiniOrange SAML 2.0 Single Sign-On (SSO) plugin for WordPress (SecurityWeek). The flaws allow unauthenticated remote attackers to forge SAML assertions, bypass single sign-on authentication barriers, and log in directly with full administrator privileges on any vulnerable WordPress website.
Deep-Dive Technical Analysis
SAML Assertion Verification Failure
The MiniOrange SAML 2.0 SSO plugin is deployed across tens of thousands of corporate WordPress portals to integrate enterprise Identity Providers (such as Okta, Microsoft Entra ID, PingFederate, and OneLogin). The vulnerabilities originate from flawed XML signature validation and assertion parsing routines:
1. Missing Cryptographic Signature Binding: During inbound SAML Response processing at the Service Provider (SP) endpoint, the plugin failed to strictly validate that the SAML assertion was signed by the configured IdP public certificate before extracting user attributes.
2. Arbitrary Identity Assertion: An unauthenticated attacker can construct a crafted SAML Response containing a self-signed or unsigned assertion declaring the NameID or email address of a target WordPress administrator account.
3. Administrative Session Minting: Upon receiving the malformed payload, the vulnerable plugin accepts the assertion as authenticated, maps the declared email to the corresponding local WordPress user, and issues a valid administrator session cookie (wordpress_logged_in_*) without prompting for secondary credentials.
4. Opportunistic Web Takeover: With administrator access, threat actors can install rogue plugins, upload PHP web shells, modify site content, and exfiltrate customer databases.
The Dangers of "Silent Patching"
Security research firm Patchstack highlighted that the exploitation wave was exacerbated by a lack of clear vulnerability communication from the vendor:
* Vague Release Notes: While the free edition of the plugin addressed the issue in version 5.4.5, the update was categorized as a minor bug fix rather than a critical security patch (SecurityWeek).
* Unnotified Premium Editions: In the paid and enterprise editions of the plugin, distinct versioning schemes and absent public security advisories left enterprise site administrators unaware that manual updates were urgently required.
* Automated Mass Scanning: Threat actors automated exploit payloads across all discovered WordPress sites hosting the plugin, knowing that many administrators delay applying routine non-security bug fixes.
Actionable Recommendations & Mitigations
1. Update All MiniOrange Plugin Editions Immediately: Manually verify that all instances of the MiniOrange SAML 2.0 SSO plugin (both Free and Premium editions) are updated to version 5.4.5 or the latest release.
2. Audit WordPress Administrator User Rosters: Inspect the WordPress user database (wp_users) for newly created administrator accounts or unrecognized email addresses.
3. Enforce Independent Hardware-Bound 2FA: Deploy secondary two-factor authentication (such as WebAuthn / FIDO2 security keys) on all administrative WordPress accounts that operate independently of SAML SSO assertions.
4. Deploy Web Application Firewall (WAF) Rules: Configure WAF rules to inspect inbound SAML POST requests to /?option=saml_user_login and block malformed or unsigned XML envelopes.
________________
Sources & References: SecurityWeek.