Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Two critical unauthenticated vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin allow attackers to bypass authentication and escalate privileges to admin access CVE-2026-61981 (CVSS 9.8) exploits a loose boolean check on PHP's `openssl_verify()` return value, treating error code -1 as a valid signature CVE-2026-61979 (CVSS 8.1) enables signature algorithm confusion for unauthenticated privilege escalation Active exploitation is underway via opportunistic scanning
Analysis
TL;DR
- Two critical unauthenticated vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin allow attackers to bypass authentication and escalate privileges to admin access
- CVE-2026-61981 (CVSS 9.8) exploits a loose boolean check on PHP's
openssl_verify()return value, treating error code -1 as a valid signature - CVE-2026-61979 (CVSS 8.1) enables signature algorithm confusion for unauthenticated privilege escalation
- Active exploitation is underway via opportunistic scanning from multiple IP addresses, with public PoC code available for chaining both flaws
- Fixes are available in plugin versions 17.0.5 and 17.0.6 for the Standard edition
Why It Matters
This vulnerability demonstrates how a seemingly minor PHP type-coercion bug in cryptographic verification can lead to complete authentication bypass with admin-level access, posing an immediate threat to thousands of WordPress sites relying on SAML-based SSO. The active exploitation and publicly available PoC make this a critical, time-sensitive issue for any organization running the affected plugin version.
Technical Details
- CVE-2026-61981 (CVSS 9.8): The
mo_saml_validate_signature()function performs a loose boolean check on the raw tri-state integer returned by PHP'sopenssl_verify(). Since PHP evaluates -1 (error return) as truthy, a deliberately malformed signature triggering an OpenSSL error is incorrectly treated as a valid signature, allowing unauthenticated login as any user including administrators viawp_set_auth_cookie() - CVE-2026-61979 (CVSS 8.1): Signature algorithm confusion vulnerability enabling unauthenticated privilege escalation, fixed in version 17.0.5
- Exploit Chain: Attackers can craft a SAMLResponse with an attacker-controlled NameID and a malformed signature that triggers an OpenSSL processing error, bypassing verification entirely and obtaining admin session cookies
- Discovery: DigitalOcean security team identified the vulnerabilities after observing anomalous WordPress administrator session attempts from outside their trusted network; the attacker obtained an admin session cookie but was blocked by network restrictions on admin panel operations
- Scanning IPs: 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, 64.225.25.188
Industry Insight
- WordPress site administrators using the miniOrange SAML plugin must immediately update to version 17.0.6 (Standard edition) or later, as active exploitation with public PoC code is already underway in opportunistic scanning campaigns
- This case reinforces the critical importance of strict type checking in cryptographic verification functions; developers should always explicitly validate
openssl_verify()return values against 1 (true) rather than relying on loose boolean evaluation - Organizations should implement network-level restrictions on WordPress admin panels behind trusted IP ranges as a defense-in-depth measure, as demonstrated by DigitalOcean's ability to detect and contain the attack despite the authentication bypass
Disclaimer: The above content is generated by AI and is for reference only.