Two SAML signature bypasses in the miniOrange SSO plugin let anyone log in as any WordPress user (CVE-2026-15981)
Active targeting of both bypasses was reported today alongside public exploit code, and any exposed WordPress site running an unpatched edition of the plugin can be taken over as admin with a single crafted SAMLResponse.
Two independent signature-verification flaws in the miniOrange SAML Single Sign On plugin let an unauthenticated attacker submit a crafted SAMLResponse and log in as any existing WordPress user, including administrators. CVE-2026-15981 treats the -1 error return of PHP's openssl_verify() as a successful verification (CVSS 9.8); CVE-2026-61979 is a signature-algorithm confusion that accepts an HMAC-SHA1 signature computed with the public RSA key as the secret (CVSS 8.1). All seven plugin editions sold under the one WordPress slug are affected.
Affected: miniOrange SAML Single Sign On – SSO Login (WordPress plugin, slug miniorange-saml-20-single-sign-on), Free edition <= 5.4.4; Premium edition <= 13.0.3; Standard edition <= 17.0.5; Premium/Enterprise/All-Inclusive multisite edition <= 20.2.7; Enterprise/All-Inclusive edition <= 26.0.2; VIP edition <= 32.0.7; VIP multisite edition <= 35.0.6
How to Test
Confirm the plugin edition and version (slug miniorange-saml-20-single-sign-on) against the fixed versions below; on sites that ran a vulnerable version, review web server logs for POSTs to the plugin's SAML ACS endpoint carrying SAMLResponse parameters that have no corresponding authentication event in your IdP logs, and audit WordPress user sessions and newly created or modified admin accounts.
How to Patch
Update to the fixed release for your edition — Free 5.4.5, Premium 13.0.4, Standard 17.0.6, Premium/Enterprise/All-Inclusive multisite 20.2.8, Enterprise/All-Inclusive 26.0.3, VIP 32.0.8, VIP multisite 35.0.7 (the Free fix is changeset 3611421, strict handling of openssl_verify return values); until updated, disable the plugin or block the SAML ACS endpoint at the web server, then rotate admin credentials on any site exposed while vulnerable.