Cybersecurity researchers have warned that attackers are actively attempting to exploit two critical security vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress that could allow unauthorized users to gain administrator level access. According to Patchstack, the flaws affect the authentication process and can enable attackers to log in as any existing WordPress user, including administrators, without valid credentials. The issues were reported by the DigitalOcean security team after suspicious administrator session activity was detected from outside its trusted network. The discovery has raised concerns because the vulnerabilities can provide complete administrative control over affected WordPress websites if security updates are not applied.
The vulnerabilities have been assigned CVE-2026-61979 with a CVSS score of 8.1 and CVE-2026-15981 with a CVSS score of 9.8. CVE-2026-61979 is an unauthenticated privilege escalation vulnerability caused by signature algorithm confusion and has been fixed in version 17.0.5 of the Standard edition of the plugin. CVE-2026-15981 is considered more severe because it allows authentication bypass by accepting malformed signatures as valid and has been addressed in version 17.0.6. Researchers explained that the issue stems from the mo_saml_validate_signature() function, where a loose boolean check on the value returned by PHP openssl_verify() causes an error response to be treated as a successful signature verification. As a result, an attacker can submit a specially crafted SAML response containing a chosen NameID and an intentionally malformed signature, allowing the plugin to create an authenticated session for any existing WordPress account, including administrator accounts.
Patchstack said the vulnerabilities were identified after DigitalOcean observed an unusual attempt to establish a WordPress administrator session from outside its trusted environment. According to the company, the attacker had already managed to obtain a valid administrator session cookie using the authentication bypass but was unable to perform administrative actions because access to the management interface was protected behind additional trusted network restrictions. Researchers also reported ongoing internet wide scanning activity aimed at identifying vulnerable WordPress installations. The observed activity originated from several IP addresses, including 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, and 64.225.25.188. Patchstack noted that the widespread scanning suggests an opportunistic campaign rather than one focused on specific organizations, with attackers attempting to exploit every site running the plugin regardless of its edition or version.
Security experts are urging WordPress administrators to update the miniOrange SAML plugin immediately to the latest patched versions to reduce the risk of compromise. The warning comes as proof of concept exploit code capable of chaining both vulnerabilities has become available, making exploitation significantly easier for threat actors. Successful exploitation could allow attackers to obtain administrator privileges, take control of affected WordPress websites, and potentially modify website content, deploy additional malicious code, or access sensitive information stored within the platform. Organizations using the plugin are advised to verify they are running the latest available version, review administrator login activity for unusual access attempts, and strengthen access controls where possible to minimize exposure while ensuring all security updates are applied promptly.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
