Your WordPress Dashboard Will Never Warn You About These SAML Forgery Bugs

If your site runs the miniOrange SAML 2.0 SSO plugin and the Plugins page shows no update available, that's not reassurance. For six of the seven editions of this plugin, the missing badge is the failure mode.

Two chainable bugs, CVE-2026-61979 and CVE-2026-15981, let an attacker forge a SAML response and get an administrator session. No password, no MFA, no IdP involved. The free edition got a fix and a public advisory in July. The six paid editions (roughly 30,000 customers) got fixes with no advisory and no dashboard warning. Exploitation is already happening. On August 16, DigitalOcean blocked a real forged admin session traced to a chained exploit against a Standard-edition site running 16.1.9.

Find your exact version, ignore the Plugins page

The paid editions will never show you an update badge. Pull the version yourself:

wp plugin list --format=table

The plugin family is seven independently versioned editions under one slug, so your version string tells you which line you're on:

Anything below your line is exposed. Go to the latest release for your edition, not just the floor. And don't trust your vulnerability scanner here: because all seven editions share one slug, scanners keyed to the free edition's version line have been reporting paid installs as safe when they weren't.

Patch or deactivate, then kill every session

Free edition: update normally and verify the version after. Paid editions: log into your Xecurify/miniOrange account, download the current build, install it manually. Waiting for the dashboard to offer it is how you stay vulnerable.

Can't patch today? Deactivate, but set a local admin password first or you'll lock yourself out:

wp user update youradminuser --prompt=user_pass
wp plugin deactivate <miniorange-slug>

Now the step almost everyone misses:

wp config shuffle-salts

The exploit produces a session cookie. Patching does nothing to cookies already issued. Shuffling salts invalidates every live session. Follow with password resets for all admins. Cheap insurance even if you think you're clean.

The hunt: an admin session with no IdP login

A legitimate SAML login has a shape. The user bounces to your identity provider, authenticates, and the IdP posts a signed response back. A forged login skips the IdP entirely. Your IdP never sees a thing.

So reconcile both sides. Pull sign-in logs from Entra ID, Okta, Google Workspace, or OneLogin for the past several weeks and compare against admin activity on the site. An admin session, settings change, or new account with no matching IdP event naming that application is your smoking gun.

Then check the plugin's own settings: IdP entity ID, SSO URL, and x.509 certificate should still match your real IdP. An attacker with admin access can swap that certificate for their own and keep signing in after you patch. That one setting turns a one-day bug into permanent access.

For the curious, the second bug is a classic PHP footgun:

if (openssl_verify($data, $signature, $key)) {
    // treated as valid
}

openssl_verify() returns 1 for valid, 0 for invalid, and -1 on internal error. In PHP, -1 is truthy. A malformed signature that makes OpenSSL choke sails through as valid. The correct check is === 1. The first bug is algorithm confusion: declare HMAC-SHA1 and the plugin verifies the signature using the IdP's public RSA key as the HMAC secret. Public keys are public. Anyone can compute a valid signature.

Do these today:

• Check your version against the matrix, not the Plugins page and not your scanner
• After patching, run wp config shuffle-salts and reset admin passwords
• Reconcile IdP sign-in logs against admin activity; no IdP event means forged
• Verify the x.509 certificate in the plugin settings still matches your IdP

Question for the comments: is there any legitimate reason to ship a security fix for a critical auth bypass with no advisory at all? I can't think of one.

Longer writeup with the full IR checklist and log-hunting commands: https://axeploit.com/blog/seven-editions-zero-dashboard-warnings-triaging-the-miniorange-saml-forgery-bugs