Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

1. Executive summary

Threat reporting describes opportunistic attempts to exploit authentication flaws in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin; the supplied verified reference covers CVE-2026-61979. CVE-2026-61979 is CVSS 8.1 HIGH, is not in CISA KEV, has EPSS 0%, and is classified as CWE-266. Successful exploitation can allow authentication as an existing WordPress user, including an administrator, although the GitHub-described certificate-trust path requires an administrator to promote an attacker-controlled certificate. EMEA financial services organisations using this plugin should update or disable it immediately and investigate SAML certificate changes and anomalous administrator sessions; the exploitation and scanner evidence is single-sourced and should be verified before enforcement.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The supplied evidence also does not establish engagement of UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties.

3. Technical analysis & attack chain

Authoritative status and scope

CVE-2026-61979 is CVSS 8.1 HIGH, CWE-266, not in CISA KEV, and has EPSS 0%. The absence of a KEV entry and the zero-percent EPSS value do not disprove the reported scanning, but the exploitation claim currently rests on reporting attributed to Patchstack through The Hacker News.

The supplied sources expose two apparently different product/version lines without explaining their relationship:

Clients should treat these as separate package or edition version lines until confirmed against the installed plugin metadata. Do not assume that 5.4.7 and 17.0.5 are interchangeable.

Confirmed CVE-2026-61979 attack chain

1. Initial access: An unauthenticated attacker supplies a SAML response carrying an attacker-controlled certificate to a vulnerable plugin installation. No endpoint, port, or transport detail is supplied.
2. Certificate ingestion: In the GitHub-described mechanism, the plugin stores the certificate carried by the SAML response without first verifying the response signature.
3. Trust promotion: The plugin exposes a one-click administrator control that promotes the stored certificate to the site’s trusted SAML signing certificate. This administrator action is a required step in the GitHub-described path; receiving the attacker’s response alone does not complete that chain.
4. Account impersonation: Once the attacker-controlled certificate is trusted, the attacker can authenticate as any existing WordPress user, including an administrator.
5. Impact: Administrator authentication gives the attacker control of the affected WordPress site. The supplied sources do not document malware deployment, persistence, command-and-control, lateral movement, data exfiltration, or compromise of systems beyond WordPress.

The authoritative classification is CWE-266. The Hacker News describes CVE-2026-61979 as signature-algorithm confusion, while GitHub documents unsafe storage and later trust promotion of an unverified certificate; these mechanism descriptions do not replace the verified CWE classification.

Source-reported companion issue

The Hacker News additionally identifies CVE-2026-15981, but no authoritative CVSS, severity, KEV state, EPSS value, or CWE for that CVE was supplied in the verified reference data. Adverse Trace therefore does not reproduce or independently assign those values.

According to the single supplied report, mo_saml_validate_signature() performs a loose boolean check on the tri-state integer returned by PHP’s openssl_verify(). An OpenSSL error result of -1 is evaluated as truthy and treated as successful verification. An unauthenticated attacker can submit a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature, trigger the error path, and cause wp_set_auth_cookie() to be called for the selected account. The report states that Standard edition 17.0.6 fixes this issue.

Observed activity and attribution

Patchstack reportedly traced the discovery to an anomalous WordPress administrator session attempt originating outside a trusted network. The attacker had allegedly obtained an administrator session cookie, but network restrictions prevented subsequent use of the administration panel. Patchstack also characterised the activity as opportunistic scanning across sites without first checking the installed edition or version.

These observations and the associated IP addresses are single-sourced through The Hacker News; verify before enforcement. No actor is named, and the supplied MITRE reference data contains no actor profile. Attribution is therefore unconfirmed.

4. Mitigation & containment

P1 — within 24 hours

1. Identify affected installations and their exact version line. From the WordPress document root, enumerate active plugins:

bash wp plugin list --status=active --fields=name,status,version,update

Record the installed plugin slug, edition and version before changing it.

2. Apply the appropriate fixed release:

• Standard edition: update to 17.0.6 or later; 17.0.5 is reported to fix CVE-2026-61979, while 17.0.6 fixes the reported companion issue.
• Installations following the GitHub advisory’s version line: update to 5.4.7 or later.
• Prefer the latest vendor-supported release for the installed edition.

bash wp plugin update <installed-miniOrange-SAML-plugin-slug>

3. If remediation cannot be completed immediately, disable the plugin:

bash wp plugin deactivate <installed-miniOrange-SAML-plugin-slug>

Confirm an approved break-glass authentication method before disabling production SSO. Restrict the WordPress administration interface to trusted networks or an authenticated access proxy; this control reportedly prevented post-authentication activity in the observed case.

4. Contain possible sessions. Preserve relevant logs, then invalidate active WordPress administrator sessions and authentication cookies. Review all successful SAML-backed administrator sessions before allowing renewed access.
5. Review reported scanner IPs in §5 across WAF, reverse-proxy and web-server logs. Use them for retrospective hunting first; any blocking decision should account for the single-source confidence caveat.

P2 — within 72 hours

1. Inspect the plugin’s stored and trusted SAML signing certificates. Compare certificate fingerprints and IdP metadata with the approved configuration. Preserve any unrecognised certificate as evidence before restoring the known-good trust configuration.
2. Review SAML/plugin logs, WordPress authentication and audit records, reverse-proxy logs, WAF events and IdP records for:

• Administrator sessions originating outside approved networks.
• Successful SAML authentication for administrators at unexpected times or from unexpected sources.
• Unrecognised certificate storage or trust-promotion events.
• Malformed-signature errors followed by successful authentication.
• Creation or modification of administrator accounts.
• Unexpected plugin or theme installation, activation, or modification.

3. Audit existing WordPress administrators and remove unauthorised access. Where compromise is suspected, reset affected credentials, revoke sessions, and validate WordPress core, plugin and theme integrity from trusted packages.
4. Confirm that no vulnerable duplicate, inactive, staging, or backup installation remains publicly reachable.

P3 — within 7 days

1. Add monitoring for changes to SAML signing-certificate trust, successful privileged SAML logins from outside approved networks, and administrator session creation.
2. Enforce network restrictions for WordPress administrative access independently of WordPress authentication.
3. Establish version and edition inventory for security-sensitive WordPress plugins and test security updates without disabling administrative break-glass access.
4. Retain evidence from any suspected exploitation and scope the investigation beyond WordPress only where host or identity telemetry shows subsequent activity.

5. Indicators of compromise

The following addresses were reported as sources of scanning. They are single-sourced; verify before enforcement.

ipv4  207[.]211[.]214[.]41
ipv4  79[.]127[.]224[.]14
ipv4  102[.]91[.]71[.]83
ipv4  162[.]243[.]116[.]148
ipv4  84[.]201[.]6[.]54
ipv4  64[.]225[.]25[.]188

Behavioural indicators

6. Detection

No YARA rule is appropriate: the supplied function names are vulnerable product code, not strings from a malicious payload, command line, or network artefact.

The following Sigma rule detects web requests from the reported scanner addresses. It requires mapping source.ip to the client-IP field used by the local web logging pipeline. The address set is single-sourced and should be used for hunting before automated enforcement.

title: miniOrange SAML Reported Scanner Source IPs
status: experimental
description: Detects inbound web requests from IP addresses reported scanning for miniOrange SAML flaws.
references:

  - https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html
author: Adverse Trace
date: 2026-08-25
logsource:
  category: webserver
detection:
  selection:
    source.ip:

      - '207.211.214.41'
      - '79.127.224.14'
      - '102.91.71.83'
      - '162.243.116.148'
      - '84.201.6.54'
      - '64.225.25.188'
  condition: selection
level: medium

CVE assessment

1 referenced CVE

7. Sources

• The Hacker News, “Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access,” 2026-08-25.
• GitHub Security Advisories, “GHSA-qj54-25r3-fmh2 — SAML Single Sign On WordPress plugin certificate-verification issue,” date not stated in supplied material.

8. Adverse Trace position

Adverse Trace positions CVE-2026-61979 at its verified CVSS 8.1 HIGH severity, with EPSS 0% and no CISA KEV entry; we do not elevate it beyond that rating. Internet-accessible financial-services WordPress deployments using the affected plugin face material site-takeover risk because the flaw can result in authentication as an existing administrator, but the supplied evidence does not establish malware deployment, lateral movement, data theft, or compromise of regulated financial systems. Exploitation observations, attribution and the IOC set are single-sourced; attribution remains unconfirmed and indicators must be verified before enforcement. Adverse Trace will monitor for independent exploitation corroboration, vendor clarification of the conflicting version lines, and changes to KEV or EPSS status.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.