Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

CVE-2026-61979 is a signature algorithm confusion flaw in the miniOrange SAML 2.0 Single Sign On WordPress plugin (Free edition ≤ 5.4.4, Standard ≤ 17.0.5, Premium ≤ 13.0.3, and four other paid editions). The plugin reads the SignatureMethod attribute from an incoming SAMLResponse — an attacker-controlled field — rather than enforcing the algorithm configured in the IdP settings. An attacker specifies HMAC-SHA1, causing the plugin to feed the IdP's publicly known RSA X.509 certificate into PHP's hash_hmac() as a shared secret. Since the attacker knows that same certificate (it ships in IdP metadata or is embedded in the plugin config), they can compute a valid HMAC signature over a forged SAML assertion claiming any user identity, including administrator. The result: an unauthenticated, remote attacker receives a valid WordPress session cookie with full admin privileges.

The vendor tagged this HIGH 8.1 with AC:H, implying meaningful attack complexity. That rating is wrong. The public key is not a secret — it is literally published in IdP metadata and sometimes rendered in the plugin's own settings page. A working proof-of-concept is on GitHub, and Patchstack has documented active exploitation from six IPs across four countries. DigitalOcean's SOC caught a live attacker who had already obtained an admin session cookie via this flaw. Separately, the companion bug CVE-2026-15981 (OpenSSL tri-state boolean confusion, CVSS 9.8) offers an independent bypass path through the same code. The vendor's AC:H dramatically understates the real-world exploitability; this is effectively AC:L once you have the PoC and the public certificate.

Why this verdict

• Active exploitation confirmed: Six IPs are mass-scanning, DigitalOcean blocked a live admin session takeover, and a public PoC exists on GitHub — this is not theoretical.
• AC:H is factually wrong: The vendor's CVSS assumes the IdP public key is hard to obtain. It is not — it is published in IdP SAML metadata by design. With the PoC, exploitation is point-and-shoot, making effective AC:L and the true base score 9.8.
• Unauthenticated full admin takeover: No credentials, no user interaction, no special network position required. Any internet-facing WordPress site running this plugin is exploitable.
• Role multiplier: The miniOrange SAML SSO plugin is deployed specifically by organizations integrating WordPress with enterprise IdPs (Okta, Azure AD, ADFS). These are not hobby blogs — they are corporate intranets, customer portals, and e-commerce platforms. Admin takeover on these sites yields access to regulated data, PII, and payment information, and can serve as a pivot point into the corporate network. Blast radius per site is host-to-tenant level, but the enterprise context elevates the data impact significantly.
• Vendor communication failure amplifies risk: Only the free edition received a public advisory. Six paid editions were patched silently without alerts, leaving paid customers unaware they need to update — a coverage gap that scanners cannot close.

Why not higher?

Already at CRITICAL 9.4. Not scored at 10.0 because the installed base is relatively small (~10K free installs plus unknown paid editions), the blast radius per exploitation is limited to a single WordPress site (not fleet-scale or identity-provider-scale), and the plugin is not a canonical high-value-role component like a DC, hypervisor, or EDR agent.

Why not lower?

Cannot be lower than CRITICAL given confirmed active exploitation, a public PoC, unauthenticated remote access with no user interaction, and full administrative takeover. The vendor's AC:H is demonstrably incorrect. Any enterprise running this plugin with SAML configured is immediately exploitable from the internet. Dropping to HIGH would ignore the live threat activity and the zero-friction attack chain.

1. Deactivate the miniOrange SAML SSO plugin immediately if not business-critical — If SAML SSO on WordPress is not essential to operations, deactivating the plugin instantly eliminates the attack surface. This is the fastest mitigation — deploy within the noisgate CRITICAL mitigation SLA of 3 days.
2. Apply the vendor patch to the correct edition — Update to the patched version for your edition (Free 5.4.5, Premium 13.0.4, Standard 17.0.6, etc.). Paid editions do NOT auto-update via wordpress.org — you must download the update from miniOrange directly. Deploy within 3 days per the noisgate CRITICAL mitigation SLA.
3. Deploy a WAF rule blocking HMAC-SHA1 in SAMLResponse — Add a WAF rule (Cloudflare, ModSecurity, Wordfence) that inspects POST bodies to the ACS endpoint (/?option=saml_user_login) and blocks requests where the SignatureMethod contains hmac-sha1. Patchstack and Wordfence have published rules. Deploy within 3 days as a stopgap if patching is delayed.
4. Restrict wp-admin and ACS endpoint access by IP — If your SAML IdP has a known egress IP range, restrict the ACS endpoint and /wp-admin to those IPs plus your corporate network via .htaccess, nginx config, or CDN rules. This limits who can submit forged SAMLResponses.
5. Audit WordPress admin sessions and recently modified files — Review wp_users and wp_usermeta for unexpected admin accounts. Check wp-content/plugins/ and active theme directories for recently modified PHP files or unfamiliar files (web shells). Use WP-CLI: wp user list --role=administrator and find wp-content -name '*.php' -mtime -14.

Run this script on the WordPress host (or any machine with SSH/file access to the WordPress installation directory). Invoke as: bash check_cve_2026_61979.sh /var/www/html (pass the WordPress root directory as the first argument). Requires read access to the plugin files — run as the web server user or root.

#!/bin/bash
# CVE-2026-61979 Checker — miniOrange SAML SSO Signature Algorithm Confusion
# Usage: bash check_cve_2026_61979.sh /path/to/wordpress
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

WP_ROOT="${1:-.}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/miniorange-saml-20-single-sign-on"

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN — miniOrange SAML SSO plugin not found at $PLUGIN_DIR"
  exit 2
fi

# Extract version from the main plugin file header
VERSION=$(grep -i 'Version:' "$PLUGIN_DIR/login.php" 2>/dev/null | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not extract plugin version from login.php"
  exit 2
fi

echo "Detected miniOrange SAML SSO version: $VERSION"

# Check for the vulnerable code pattern: accepting attacker-controlled SignatureMethod
# In patched versions (5.4.5+), the plugin enforces the configured algorithm
if grep -q 'hmac-sha1\|HMAC.*SHA1\|cast_key' "$PLUGIN_DIR/includes/lib/mo-saml/Utilities.php" 2>/dev/null; then
  # Check if the fix is present (enforced algorithm check)
  if grep -q 'configured_algorithm\|enforceAlgorithm\|ALLOWED_ALGORITHMS' "$PLUGIN_DIR/includes/lib/mo-saml/Utilities.php" 2>/dev/null; then
    echo "PATCHED — version $VERSION contains algorithm enforcement fix"
    exit 0
  fi
fi

# Version-based check for the free edition
# Vulnerable: <= 5.4.4, Patched: >= 5.4.5
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
if [ "$MAJOR" -lt 5 ] 2>/dev/null; then
  echo "VULNERABLE — version $VERSION is below the patched release (5.4.5)"
  exit 1
elif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -lt 4 ] 2>/dev/null; then
  echo "VULNERABLE — version $VERSION is below the patched release (5.4.5)"
  exit 1
elif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 4 ] && [ "$PATCH" -le 4 ] 2>/dev/null; then
  echo "VULNERABLE — version $VERSION is below the patched release (5.4.5)"
  exit 1
elif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 4 ] && [ "$PATCH" -ge 5 ] 2>/dev/null; then
  echo "PATCHED — version $VERSION is at or above the fixed release"
  exit 0
elif [ "$MAJOR" -gt 5 ] 2>/dev/null; then
  # Paid editions use higher major versions — check known patched thresholds
  # Premium: 13.0.4+, Standard: 17.0.6+, Prem/Ent MS: 20.2.8+, Ent/AI: 26.0.3+, VIP: 32.0.8+, VIP MS: 35.0.7+
  echo "NOTE — Paid edition detected (v$VERSION). Known patched versions:"
  echo "  Premium >= 13.0.4 | Standard >= 17.0.6 | Prem/Ent MS >= 20.2.8"
  echo "  Ent/All-Inclusive >= 26.0.3 | VIP >= 32.0.8 | VIP MS >= 35.0.7"
  echo "UNKNOWN — manually verify your edition against the thresholds above"
  exit 2
fi

echo "UNKNOWN — could not determine patch status for version $VERSION"
exit 2

Sources

1. Patchstack — Full Technical Writeup (7 Editions)
2. The Hacker News — Active Exploitation Coverage
3. BleepingComputer — Attack Campaign Details
4. GitHub Advisory GHSA-wgjx-q85h-87v2 (CVE-2026-15981)
5. WordPress.org — Plugin Page and Changelog
6. WPScan — miniOrange SAML Vulnerability History
7. GBHackers — Critical miniOrange SAML SSO Analysis