SECURITY ALERT
Two critical miniOrange SAML SSO authentication bypasses are seeing exploitation attempts. The safe version depends on the plugin edition—not one simple version number.
Reporting cutoff: August 24, 2026, 5:33 p.m. Eastern (2026-08-24T21:33:34Z).
Owners of WordPress sites using the miniOrange SAML 2.0 Single Sign On plugin should verify their exact edition and installed version now. The two flaws can allow an unauthenticated attacker to forge a SAML response and obtain a session for an existing WordPress user, including an administrator, according to the joint Patchstack/DigitalOcean analysis.[1]
The vulnerabilities are tracked as CVE-2026-61979 and CVE-2026-15981. Patchstack rates both critical at CVSS 9.8. NVD records a 9.8 CNA score for CVE-2026-15981; its CVE-2026-61979 entry has not been prioritized for NVD enrichment and currently shows no NVD score.[1][2][3]
Why this alert is easy to misread
miniOrange ships seven edition/version lines under one WordPress plugin slug. The free edition uses a 5.x version, while paid lines use 13.x, 17.x, 20.x, 26.x, 32.x and 35.x versions. A rule such as “anything above 5.4.5 is safe” can therefore produce a false sense of security for a paid installation.
| Edition | Vulnerable through | Minimum release closing both flaws |
|---|---|---|
| Free, single site | 5.4.4 | 5.4.5 |
| Premium, single site | 13.0.3 | 13.0.4 |
| Standard, single site | 17.0.5 | 17.0.6 |
| Premium / Enterprise / All-Inclusive, multisite | 20.2.7 | 20.2.8 |
| Enterprise / All-Inclusive, single site | 26.0.2 | 26.0.3 |
| VIP, single site | 32.0.7 | 32.0.8 |
| VIP, multisite | 35.0.6 | 35.0.7 |
This matrix is the later version scope Patchstack says miniOrange supplied after follow-up about paid editions.[1] The free plugin’s WordPress.org changelog says 5.4.5 fixed an “unauthorised access issue in SAML SSO.”[4]
The NVD scope discrepancy matters
NVD currently describes CVE-2026-61979 as affecting the free plugin through 5.4.3, while Patchstack’s later vendor-supplied matrix says the free edition is vulnerable through 5.4.4 and first fixed in 5.4.5.[1][2] NVD describes CVE-2026-15981 as affecting versions through 5.4.4.[3]
We are preserving that discrepancy rather than smoothing it over. For remediation, use the later edition-aware matrix and the WordPress.org 5.4.5 changelog for the free line. For paid editions, verify the installed product line and entitlement through your approved vendor channel.
What “active attacks” means here
Patchstack says exploitation has been attempted in the wild and describes the observed activity as opportunistic scanning. DigitalOcean detected and blocked an anomalous administrator-session attempt, then reproduced both flaws against Standard edition 16.1.9.[1]
Those observations establish practical exploitation attempts. They do not establish how many sites remain vulnerable, how many attempts succeeded elsewhere, who operated the activity, or whether any named organization was compromised. A blocked attempt is not a breach count.
Safe, non-destructive response
- Inventory before changing anything. Check for plugin slug
miniorange-saml-20-single-sign-on, record the exact edition and installed version, and preserve the result. - Compare against the matching row. Do not use a single contiguous scanner range across all editions.
- Update through an authorized, tested path. Move to at least the fixed release for that edition, or remove the plugin if it is confirmed unused. Paid editions may require a manual vendor package rather than a normal dashboard update.
- If compromise is suspected, preserve evidence first. Retain authentication logs, web logs, administrator activity, plugin files, timestamps and hosting telemetry before cleanup could erase them.
- Contain based on evidence. Review unexpected administrator sessions and accounts. Rotate affected sessions or credentials from a clean system only when incident response justifies it; do not trigger a broad destructive reset solely from a version match.
- Verify the result. Confirm the expected edition and fixed version are actually active, old plugin copies are absent, legitimate SSO still works, administrator activity is understood, and monitoring remains stable.
What site owners should not do
- Do not scan sites you do not own or lack explicit authority to test.
- Do not run public exploit code against production.
- Do not assume a WordPress update notice covers paid editions.
- Do not call a vulnerable version proof of compromise.
- Do not destroy logs or reimage first when suspicious activity may need investigation.
Bottom line
The immediate decision is edition-aware: identify the exact miniOrange SAML SSO edition, compare it with the correct fixed-version row, and remediate through an approved change process. The public evidence supports urgent attention and careful investigation—but not claims of widespread successful compromise or exposure of any specific customer.