Attackers chain two miniOrange WordPress SSO flaws to forge admin logins

Attackers are exploiting two critical authentication-bypass flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, chaining them to forge login responses and sign in as an administrator. The first flaw, CVE-2026-61979, lets the plugin accept an attacker-chosen signature algorithm, so the identity provider's public key can be abused as a shared secret to forge a valid signature; the second, CVE-2026-15981, makes the plugin treat a signature-verification error as success. Both were fixed in July, but the vendor only alerted free-edition users, leaving paid editions unpatched. Security firm Patchstack traced an attack in mid-August where the two were chained to steal an administrator session cookie.

Check

Update the miniOrange SAML Single Sign On plugin on all WordPress sites, including paid editions that were not alerted, and audit for unexpected administrator accounts and sessions.

Affected

WordPress sites using the miniOrange SAML 2.0 Single Sign On plugin (CVE-2026-61979, CVE-2026-15981); chaining the two lets an unauthenticated attacker forge a SAML response and obtain an administrator session.

Fix

Patch or remove the plugin, rotate WordPress salts and admin passwords to invalidate stolen sessions, check for rogue admins, and put a web application firewall in front of login endpoints.