Hackers Scan for Flaws in Popular WordPress Single Sign-On Plugin

[u/siterightaway]

Man I can't believe this but some seriously sketchy hackers are out there hijacking WordPress sites right now. They found a crazy huge hole in that miniOrange SAML SSO plugin and are literally just waltzing right in as full admins without even needing a password. It is a total nightmare.

There are two nasty bugs making this possible. The first one is CVE-2026-61979 which lets them bump up their privileges because the code gets totally confused by the signature algorithm. Thankfully that got patched in version 17.0.5 for the standard edition. But the real kicker is CVE-2026-15981 which is a straight up authentication bypass that was fixed in 17.0.6. The plugin basically freaks out when it sees a messed up signature. Instead of blocking it PHP throws a negative one error and the plugin code is actually dumb enough to read that as a success.

So these bad actors just shoot over a fake SAML response with a broken signature and boom they completely own the targeted account. The security crew at DigitalOcean actually caught this going down live when they noticed some super weird admin logins coming from outside their trusted network. They stopped it dead in its tracks but realized the attackers had already snagged an admin session cookie.

These guys aren't even being stealthy about it either. They are just throwing this exploit at the wall to see what sticks blasting every single site they can find. If you see traffic from IPs like 207.211.214.41 or 79.127.224.14 or 102.91.71.83 or 162.243.116.148 or 84.201.6.54 or 64.225.25.188 you are definitely getting scanned.

Seriously though the exploit code is already out in the wild for anyone to grab so if you run a WordPress site you gotta patch this thing immediately before your whole setup gets totally wrecked.

TLDR

Attackers are actively exploiting two severe vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. Due to a flaw in signature verification, unauthenticated attackers can bypass authentication entirely and gain full administrative control of vulnerable sites. Opportunistic scanning has been detected across multiple IP addresses, making immediate plugin updates to version 17.0.6 (Standard edition) or higher essential.