miniOrange SAML SSO exploited: paid editions won't prompt

Two unauthenticated authentication bypasses in the miniOrange SAML 2.0 Single Sign On plugin for WordPress are being exploited right now, and the ugly part is not the bug. It is the distribution. The plugin ships under one WordPress slug with seven separately versioned editions, and the six paid ones will never show you an update notice in wp-admin. If you bought SSO for your WordPress site, nobody is going to tell you it is open.

What actually happened

Patchstack's writeup — one slug, seven editions — describes two flaws, both rated CVSS 9.8. CVE-2026-61979 is signature algorithm confusion: the plugin will accept HMAC-SHA1 and hand it the public RSA key as the shared secret, so anyone who can read your public certificate can forge a signature. CVE-2026-15981 is worse in a dumber way — OpenSSL's verify call returns -1 on error, and the code treats anything that is not 0 as valid. Either one lets an unauthenticated attacker forge a SAML assertion and arrive in /wp-admin as any existing user, including the administrator.

Per BleepingComputer, DigitalOcean's security team caught an anomalous WordPress administrator session originating outside its trusted network on August 16. Exploitation attempts have since come from six IP addresses across Europe, Africa, and the United States, and proof-of-concept code is public. The free edition lists roughly 10,000 installs; the vendor claims about 30,000 customers across all editions.

Fixed builds, by edition: free 5.4.5, Premium single-site 13.0.4, Standard single-site 17.0.6, Premium/Enterprise multisite 20.2.8, Enterprise/All-Inclusive single-site 26.0.3, VIP single-site 32.0.8, VIP multisite 35.0.7. Version 13.0.4 and 5.4.5 are the same plugin. That is the problem.

Why a WordPress plugin bypass matters for your business

Your SSO plugin is your login. Every other control you bought — MFA on the IdP, conditional access, session limits — sits upstream of a signature check that accepts a forged assertion. The attacker never touches your identity provider. They talk to WordPress directly.

Paid tiers are invisible to your patch process. The public advisories only ever covered the free edition, and the paid editions were fixed with no changelog and no dashboard prompt. If your update routine is "log in, look for the orange badge," your commercial plugins are on a different track than your monitoring.

One slug, seven version trees, wrong answers everywhere. A scanner comparing your installed version string against the free edition's fixed release will confidently clear a vulnerable VIP install. Check the edition first, then the version.

Public PoC plus opportunistic scanning means hours, not weeks. Six IPs spraying is not a targeted campaign against you. It is a crawler. Being small is not cover.

Sources: Patchstack, BleepingComputer.