Exploitation observed; activity peaked at 8 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-24 | 2 | Disclosure1General1 |
| 2026-08-24 | 3 | Active Exploitation3 |
| 2026-08-25 | 8 | Active Exploitation2Disclosure4General1Patch1 |
| 2026-08-26 | 4 | Active Exploitation4 |
| 2026-08-27 | 2 | Active Exploitation1PoC1 |
| 2026-09-02 | 3 | Active Exploitation1General1Patch1 |
| 2026-09-03 | 1 | Active Exploitation1 |
CVE-2026-15981 is being exploited in public using the POC code. IPs seems to be from Russia and targeting WPMU DEV Dashboard plugin. if you have the plugin or any SAML Single Sign On based plugins.
Post summary
The post announces that CVE-2026-15981 is actively exploited in the wild using a PoC against the WPMU DEV Dashboard plugin, primarily from Russian IPs.
Two critical authentication-bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin enable unauthenticated account takeover, including administrator access. - CVE-2026-61979 allows SAML signature-algorithm confusion, while CVE-2026-15981 incorrectly accepts signatures after OpenSSL errors.
Post summary
The post announces two critical authentication-bypass flaws in the miniOrange SAML 2.0 plugin that allow unauthenticated account takeover via SAML signature manipulation, but it provides no evidence of active exploitation, PoC, or patch information.
Attackers are scanning for two CVSS 9.8 auth bypasses (CVE-2026-61979, CVE-2026-15981) in the miniOrange SAML SSO WordPress plugin. Chained, they allow login as any user including admin. All versions up to 5.4.4 affected. Source: The Hacker News
Post summary
The text announces two critical CVSS 9.8 chained authentication bypass vulnerabilities in the miniOrange SAML SSO WordPress plugin, affecting all versions up to 5.4.4, and notes that attackers are actively scanning for them.
how do you go though access.log to track an incident or a timeline of events? this is an example of CVE-2026-15981 & CVE-2026-76581 attack taking place https://t.co/xlAnxkFLdl
Post summary
The tweet indicates that CVE-2026-15981 and CVE-2026-76581 are being actively exploited, but offers no deeper technical or remedial information.
WordPress miniOrange SAML SSO の脆弱性 CVE-2026-61979／15981 が FIX：Admin 権限奪取の恐れ https://iototsecnews.jp/2026/08/25/hackers-exploit-critical-miniorange-saml-sso-flaws-to-hijack-wordpress-admin-accounts/ WordPress miniOrange SAML SSO プラグインにおける、SAML 署名検証の不備を解説する記事です。署名アルゴリズム混同 CVE-2026-61979 や関数戻り値の不適切な型比較 CVE-2026-15981 が背景として存在します。その結果として、認証レスポンス偽造による未認可ログイン／管理者権限の奪取／不正アクセスといった深刻な影響が懸念されます。共有プラグイン・スラッグの仕様上、利用中の製品版で安全更新通知が届かないリスクもあります。影響を受ける最新ビルドへ手動で更新を適用する対応やアクセスログの入念な監視が求められます。 #CVE202615981 #CVE202661979 #miniOrangeSAMLSSO #Vulnerability #WordPress
Post summary
The article details the MiniOrange SAML SSO vulnerabilities CVE‑2026‑61979 and CVE‑2026‑15981, explains the risk of unauthorized admin hijack, and recommends patching by manually updating to the latest build and monitoring logs, but it does not provide exploit code or evidence of active exploitation.
A public certificate is all it takes to log into WordPress as admin. miniOrange SAML SSO (CVE-2026-15981, CVSS 9.8) accepts a forged SAML assertion — unauth, one HTTP request. DigitalOcean already blocked a live attempt. ~30k sites. Fix runbook 🧵 🧵 1/5
Post summary
miniOrange SAML SSO CVE‑2026‑15981 enables unauthenticated admin logins via forged SAML assertions, with live exploitation observed (DigitalOcean blocked an attempt) and a runbook provided for mitigation.
WordPress向けminiOrange SAML SSOに認証バイパス2件、管理者乗っ取り可能 サイバー攻撃への試行も確認(CVE-2026-15981,CVE-2026-61979) https://rocket-boys.co.jp/security-measures-lab/wordpress-miniorange-saml-sso-auth-bypass-takeover/
Post summary
The post reports two authentication bypass CVEs for miniOrange SAML SSO on WordPress, noting confirmed cyber‑attack attempts but offering no technical details or mitigations.
CVE-2026-61979 and CVE-2026-15981 in miniOrange SAML WordPress plugin allow unauthenticated attackers to log in as admins, DigitalOcean says.
Post summary
The post reports that two CVEs in the miniOrange SAML WordPress plugin allow unauthenticated attackers to log in as administrators, but no PoC, exploit, patch, or evidence of live exploitation is provided.
CVE-2026-61979 and CVE-2026-15981, both CVSS 9.8, let unauthenticated attackers forge SAML responses and land in wp-admin on miniOrange SAML plugin installs. #DFIR_Radar https://t.co/mUr3yWdqq8
Post summary
The tweet announces two high‑severity CVEs (CVSS 9.8) that allow unauthenticated attackers to forge SAML responses and gain admin access on miniOrange SAML plugin installs, but it does not provide PoC, active exploitation, or patch information.
🛡️ CYBER BULLETIN | 2026/08/25 🚨 1. CISA adds critical Oracle WebLogic flaw to KEV catalog CISA has listed CVE-2026-21962 (CVSS 10.0) affecting Oracle HTTP Server and WebLogic Server Proxy Plug-in after confirmed active exploitation. Unauthenticated attackers can gain unauthorized access or modify critical data via HTTP. Federal agencies must remediate by August 27. 2. Attackers actively exploiting miniOrange SAML WordPress plugin Two severe authentication bypass flaws (CVE-2026-61979 and CVE-2026-15981) in the popular miniOrange SAML 2.0 SSO plugin allow unauthenticated attackers to log in as any user, including admins. Exploitation attempts are already underway—patch immediately to the fixed versions. 3. Iran-linked hackers shut down UK power plant for four days Hackers affiliated with Iran reportedly disrupted a small-scale UK power generator in July, forcing a four-day outage. While the wider grid was unaffected, the incident highlights growing risks to distributed energy infrastructure from state-linked actors.
Post summary
CISA has added CVE-2026-21962 to its KEV catalog after confirmed active exploitation, and two severe authentication bypass flaws in the miniOrange SAML WordPress plugin are already in use; urgent patches are mandated.
this is how CVE-2026-15981 is being used in wordpress attacks https://t.co/rYTRTWg7Ri
so in reality, there is some mixing of CVE numbers floating around. CVE-2026-15981 is the miniOrange/SAML authentication bypass (the openssl_verify -1 treated as true bug). The WPMU DEV Dashboard issue that Wordfence wrote about is actually CVE-2026-76581
Post summary
The message clarifies that CVE‑2026‑15981 is the miniOrange/SAML authentication bypass and that the WPMU DEV Dashboard issue actually maps to CVE‑2026‑76581.
The forged login leaves a valid session, not a crash. Nothing downstream flags it; the only proof is testing whether the door opens. That's what our 10-agent pentest does: forge the assertion, report if an admin session came back. https://zerohunt.ai/blog/miniorange-saml-sso-cve-2026-15981-wordpress-auth-bypass/#remediation 5/5
Post summary
The brief notes a pentest that shows an auth bypass via forged SAML assertions for CVE-2026-15981, but it does not provide exploit code, patch details, or evidence of active exploitation.
🚨 ONE ASSERTION BECAME ADMIN CVE-2026-61979 and CVE-2026-15981 are critical authentication bypasses in the miniOrange SAML 2.0 Single Sign On plugin. Both can allow an unauthenticated attacker to forge a SAML assertion and enter WordPress as an existing user—including an administrator. The warning: ⚠️ CVE-2026-61979 exploits signature-algorithm confusion ⚠️ CVE-2026-15981 treats an OpenSSL error return as successful verification ⚠️ Exploitation attempts and opportunistic scanning have been observed Security teams should: ✅ Identify the exact miniOrange edition and version deployed ✅ Upgrade to the patched release listed for that edition ✅ Manually verify updates when WordPress shows no available upgrade ✅ Review administrator sessions from unexpected IP ranges ✅ Reset affected sessions and investigate unauthorised administrative changes One version range cannot describe all seven independently versioned editions. Administrators must use the complete edition-specific remediation matrix. 🚀 Join Cert‑IX Early Access: https://cert-ix.com/early-access 🔎 Complete analysis: https://blog.cert-ix.com/articles/critical-saml-flaws-in-miniorange-a-gateway-for-admin-exploits-mt8hwjlv #miniOrange #SAML #WordPressSecurity #AuthenticationBypass #IdentitySecurity #CVE202661979 #CVE202615981 #CyberExposureManagement #CTEM #CertIX
Post summary
The post alerts on critical authentication bypasses in the miniOrange SAML plugin, confirms that attackers are already exploiting them, and urges administrators to apply the patched releases and monitor for unauthorized accesses.
Threat actors actively target WordPress websites using 2 patched vulns. Info, incl. fix info, now at #SecAlerts: CVE-2026-15981, CVSS 9.8 - https://secalerts.co/vulnerability/CVE-2026-15981 CVE-2026-61979, CVSS 8.1 - https://secalerts.co/vulnerability/CVE-2026-61979 #ciso #cio #cto #vulnerabilities #cybersecurity #msp #mssp https://t.co/h9gG4qgSZc
Post summary
Threat actors are actively exploiting two patched WordPress vulnerabilities (CVE-2026-15981 and CVE-2026-61979), with fix information available through provided links.
WordPress向けminiOrange SAML SSOに認証バイパス2件、管理者乗っ取り可能 サイバー攻撃への試行も確認(CVE-2026-15981,CVE-2026-61979) https://rocket-boys.co.jp/security-measures-lab/wordpress-miniorange-saml-sso-auth-bypass-takeover/ #セキュリティ対策Lab #security #securitynews #セキュリティ #脆弱性
Post summary
Two authentication bypass vulnerabilities (CVE-2026-15981, CVE-2026-61979) in the miniOrange SAML SSO plugin for WordPress enable admin takeover, with confirmed attack attempts reported.
Threat actors are actively targeting WordPress websites through two critical authentication bypass vulnerabilities — CVE-2026-61979 and CVE-2026-15981 — in the MiniOrange SAML 2. https://cvetodo.com/news/miniorange-wordpress-saml-plugin-under-active-attack-as-silent-patches-leave-admins-exposed #WordPress #miniOrange #AuthBypass #CVE #InfoSec https://t.co/WxFabKGmpW
Post summary
Threat actors are currently exploiting two MiniOrange SAML authentication‑bypass CVEs in WordPress sites, though the tweet lacks PoC, exploit code, or patch details.
WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities: CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin. The post WordPress Websites Targeted via MiniOrange Plugin… https://www.securityweek.com/wordpress-websites-targeted-via-miniorange-plugin-vulnerabilities/?utm_source=dlvr.it&utm_medium=twitter https://t.co/ZfQ1wLOyqk
Post summary
The post announces two new authentication bypass CVEs for the MiniOrange SAML SSO plugin on WordPress but offers no PoC, exploit code, or remediation details.
New critical vulnerabilities in the miniOrange SAML 2.0 plugin are letting attackers bypass authentication and log in as WordPress admins. CVE-2026-61979 and CVE-2026-15981 involve signature algorithm flaws and malformed signature errors in OpenSSL. Owners running pre-17.0.6 versions are at serious risk—update immediately to secure admin access and prevent chain exploits. #WordPress #SAML #miniOrange #Vulnerability #Cybersecurity #EditionsPatch https://thedailytechfeed.com/critical-miniorange-saml-bugs-let-attackers-become-wordpress-admins/
Post summary
The post highlights newer critical signature flaws in the miniOrange SAML plugin that could let attackers become WordPress admins and urges admins to update the plugin immediately.
Attackers are forging SAML responses to bypass WordPress authentication in miniOrange SSO plugin exploits. TRC analysis shows threat actors gained admin access through CVE-2024-61979 and CVE-2024-15981, then escalated privileges within compromised CMS environments. Runtime segmentation helps contain post-compromise lateral movement. #CloudSecurity 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/hackers-target-wordpress-sites-miniorange-auth-bypass-attacks-cve-2026-61979-cve-2026-15981
Post summary
The post reports that attackers are actively exploiting CVE-2024-61979 and CVE-2024-15981 by forging SAML responses to bypass miniOrange plugin authentication, obtaining admin access and escalating privileges in WordPress sites.