Affected Systems

Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin, Standard edition versions prior to 17.0.6. CVE-2026-61979 (CVSS 8.1) fixed in 17.0.5; CVE-2026-15981 (CVSS 9.8) fixed in 17.0.6. Both allow unauthenticated attackers to bypass authentication and sign in as any user including administrators.

Exploitation Status

Active exploitation confirmed. Attackers are scanning and exploiting vulnerable sites. PoC code publicly available. DigitalOcean observed real-world admin session hijacking attempts. Scanning activity detected from multiple IP addresses (207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, 64.225.25.188) indicating opportunistic mass exploitation.

Business Impact

Complete WordPress site compromise possible. Attackers can obtain administrator privileges without authentication, enabling full site takeover, data theft, malware injection, and defacement. CVE-2026-15981 exploits signature validation flaw in mo_saml_validate_signature() where openssl_verify() error return (-1) is treated as valid. CVE-2026-61979 exploits signature algorithm confusion. Both allow crafted SAML responses to bypass authentication entirely. Affects any WordPress site using vulnerable miniOrange SAML plugin versions.

Urgency

🔴 Immediate

Recommended Actions

  • Update miniOrange SAML 2.0 Single Sign On plugin to version 17.0.6 or later immediately on all WordPress installations
  • Review WordPress admin access logs for unauthorized sessions, particularly from IPs 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, 64.225.25.188
  • Audit all WordPress user accounts for unauthorized additions or privilege escalations since plugin installation
  • Implement network-level restrictions on WordPress admin panel access if not already in place
  • Monitor SAML authentication logs for malformed signatures or anomalous authentication attempts