miniOrange SAML Single Sign On – Unauthenticated Authentication Bypass Across Seven Editions

Patchstack published a new technical analysis on August 21, 2026 covering two miniOrange SAML Single Sign On authentication bypass vulnerabilities that are more complicated than the original public advisories suggested. The public records covered the free plugin line, but the same slug is used for seven separately versioned editions, including paid single-site, multisite, Enterprise, All-Inclusive, and VIP builds.

The practical risk is critical: an unauthenticated attacker may be able to submit a forged or malformed SAML response and land in WordPress as an existing user, including an administrator. Patchstack attributes the paid-edition root-cause analysis to DigitalOcean, which also reported scanning and blocked an attempted administrator session outside its trusted network.

Affected Versions

The WordPress.org free plugin currently shows version 5.4.7 and 10,000+ active installations. Administrators running paid editions should not rely only on the WordPress dashboard update indicator. Patchstack notes that vulnerable 16.x Standard installs may show no available update even though the patched 17.x line exists and requires a manual plugin upload.

CVE And Attack Class

• CVE-2026-61979: signature algorithm confusion. The SAML response can influence the signature algorithm, leading to unsafe HMAC handling with public key material. The public free-edition CVE record lists CVSS 8.1, but the paid-edition analysis treats the impact as critical because administrator login is reachable.
• CVE-2026-15981: OpenSSL verification result confusion. PHP openssl_verify() returns 1 for valid, 0 for invalid, and -1 for an OpenSSL error. The vulnerable validation path treats the error return as truthy, so a malformed signature can be accepted. NVD lists CVSS 9.8 critical for the free-edition record.

Immediate Remediation

• Identify the exact miniOrange SAML edition, not just the plugin slug.
• Update to the patched version for that edition. Paid editions may need a manual ZIP upload from miniOrange instead of a dashboard update.
• Review recent administrator sessions, especially logins from IP ranges outside the expected corporate, VPN, or hosting networks.
• Force logout of all sessions and rotate administrator passwords if suspicious SAML-backed access is found.
• Place /wp-admin/ behind a trusted network, VPN, SSO-aware proxy, or additional access rule where operationally possible.

Defensive Checks

Use WP-CLI to confirm the free plugin version where applicable. Paid editions may report the same slug but a different versioning track, so confirm the edition from the miniOrange plugin screen or license portal as well.

wp plugin get miniorange-saml-20-single-sign-on --fields=name,version,status
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

For access-log review, look for unexpected SAML authentication posts followed by administrator access from an unfamiliar IP. Keep the check defensive and correlate with your IdP logs rather than replaying any payload.

# Apache / Nginx examples: adjust paths for your host
grep -Ei 'SAMLResponse|saml|wp-login.php|wp-admin' /var/log/nginx/access.log*
grep -Ei 'SAMLResponse|saml|wp-login.php|wp-admin' /var/log/apache2/access.log*

Temporary Mitigation If You Cannot Update

The correct fix is the vendor patch. If a maintenance window is needed, restrict access to WordPress administration and SAML assertion consumer endpoints to trusted source networks while preparing the update. For high-risk public admin panels, require an additional edge control before WordPress receives the request.

# Nginx concept: allow only trusted office/VPN ranges to wp-admin.
# Replace the example subnet before use.
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}

Patchstack also published narrow code-level hotfix guidance from DigitalOcean for environments that cannot update immediately. Treat those edits as an emergency bridge only: local plugin edits can be overwritten and should be replaced by the official miniOrange build as soon as possible.

Sources

• Patchstack technical analysis
• NVD CVE-2026-15981
• CVE-2026-61979 record
• WordPress.org plugin page