Hackers are actively exploiting two critical authentication bypass flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, chaining CVE-2026-61979 and CVE-2026-15981 to forge SAML responses and gain administrator access. Patchstack says attacks are underway against both free and paid editions, with a publicly available PoC and multiple IPs already used in scanning and exploitation attempts. #miniOrange #Xecurify #CVE-2026-61979 #CVE-2026-15981 #Patchstack #WordPress #DigitalOcean
Keypoints
- Two authentication bypass bugs can be chained to log in as WordPress administrators.
- CVE-2026-61979 lets attackers influence the signature algorithm and forge SAML signatures.
- CVE-2026-15981 treats an OpenSSL verification error as a successful validation result.
- Patchstack observed real exploitation against version 16.1.9 of the Standard edition.
- All affected versions were fixed, but paid editions did not receive a clear vendor warning.