CVE-2026-15981
CVSS 9.8 CRITICAL: the SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. EPSS 2% (79th percentile).
Vulnerabilities · 49 days ago
Patchstack says attackers are scanning for two Xecurify miniOrange SAML 2.0 Single Sign On WordPress flaws, CVE-2026-61979 and CVE-2026-15981, and a public proof of concept is now available. The bugs can let an unauthenticated attacker sign in as any WordPress user, including an administrator.
The break is in the SAML trust check: a malformed or confused signature can be treated as valid, so WordPress mints a logged-in session cookie for the attacker instead of rejecting the login. Once that happens, the site is already compromised even if the admin panel sits behind a trusted network.
That makes the exposure sit in the login path, not at the panel. For WordPress fleets using this plugin for staff or admin access, the question is whether any unpatched instance can still accept a forged SAML assertion and hand over a standing admin session.
CVSS 9.8 CRITICAL: the SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. EPSS 2% (79th percentile).
CVSS 8.1 HIGH: unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. EPSS 0.4% (28th percentile).
3 sources covering this story
WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin.
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Attackers are scanning for two miniOrange SAML flaws, including CVE-2026-15981, that can bypass login and grant WordPress admin access.
Hackers target WordPress sites in miniOrange auth bypass attacks
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators.
Part of the PlainSec briefing for 2026-08-26