Ethical Hacking News
Attackers are exploiting vulnerabilities in the miniOrange SAML 2.0 Single Sign-On plugin, allowing them to grant access to WordPress admin panels and potentially take control of susceptible sites. WordPress site owners are advised to apply the latest fixes to stay protected.
MiniOrange's SAML 2.0 Single Sign-On plugin has been vulnerable to attacks targeting CVE-2026-61979 and CVE-2026-15981. These vulnerabilities can be exploited to grant attackers access to WordPress admin panels. Attackers can log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse. The DigitalOcean security team discovered the vulnerabilities after observing anomalous WordPress administrator session attempts. WordPress site owners are advised to apply the latest fixes to stay protected.
miniOrange, a leading provider of single sign-on (SSO) solutions, has recently faced a security threat courtesy of attackers targeting vulnerabilities in their SAML 2.0 Single Sign-On plugin. These vulnerabilities, specifically CVE-2026-61979 and CVE-2026-15981, can be exploited to grant attackers access to the WordPress admin panel. This can potentially result in the attackers gaining control of susceptible WordPress sites, including those with administrative access. The attackers are utilizing a proof-of-concept (PoC) code to exploit these vulnerabilities, which enables the chaining of flaws to obtain admin privileges.
According to a description of CVE-2026-15981 on CVE.org, the mo_saml_validate_signature() function in the plugin performs a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(). This results in an error return value of -1 being evaluated as truthy and treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
The DigitalOcean security team discovered the vulnerabilities after observing an anomalous WordPress administrator session attempt from outside their trusted network. The scanning activity has been recorded from the following IP addresses: 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, and 64.225.25.188. It appears that the attackers are utilizing opportunistic scanning rather than a targeted campaign, as the spread of scanning activity across multiple sites with the plugin installed suggests.
WordPress site owners are advised to apply the latest fixes to stay protected, especially given the availability of a proof-of-concept (PoC) code that allows attackers to chain the flaws to obtain admin privileges and take control of susceptible sites. The WordPress security company credited the DigitalOcean security team for reporting the issues and recommended that site owners apply the latest fixes to stay protected.
The attackers are taking advantage of the vulnerabilities in the miniOrange SAML 2.0 Single Sign-On plugin to grant access to WordPress admin panels. These vulnerabilities can be exploited to allow unauthenticated attackers to log in as any existing WordPress user, including administrators. The attackers are utilizing a proof-of-concept (PoC) code to exploit these vulnerabilities, which enables the chaining of flaws to obtain admin privileges. WordPress site owners are advised to apply the latest fixes to stay protected.
Related Information:
https://www.ethicalhackingnews.com/articles/Exploiting-Vulnerabilities-in-miniOrange-SAML-20-Single-Sign-On-Plugin-ehn.shtml
https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html
https://nvd.nist.gov/vuln/detail/CVE-2026-61979
https://www.cvedetails.com/cve/CVE-2026-61979/
https://nvd.nist.gov/vuln/detail/CVE-2026-15981
https://www.cvedetails.com/cve/CVE-2026-15981/
Published: Tue Aug 25 05:01:21 2026 by llama3.2 3B Q4_K_M
