Two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin let an attacker log into your WordPress site as any user, including an administrator, without a password. Both flaws carry the maximum severity score of 9.8 out of 10.

What happened

The DigitalOcean security team found the first signs of an attack on August 16, 2026, when their defense-in-depth monitoring flagged an unusual administrator login attempt. Working with DigitalOcean, Patchstack traced the attack to two authentication bypasses in the plugin, tracked as CVE-2026-61979 and CVE-2026-15981.

Both flaws let an attacker forge a SAML assertion, the digital token the plugin uses to confirm someone’s identity during single sign-on. A forged assertion tricks the plugin into treating the attacker as a legitimate, already-logged-in user. No password or account is needed.

Why paid customers were left in the dark

The miniOrange SAML SSO plugin ships from one WordPress.org slug, but it actually covers seven separate editions: a free version and six paid tiers, including Premium, Standard, Enterprise, and VIP, each sold in single-site and multisite variants. Each edition runs its own version numbers.

When the fix shipped, the public advisory only covered the free edition, moving it from version 5.4.4 to 5.4.5. Vulnerability databases used that range to judge every install. Since the paid editions all carry version numbers well above 5.4.5, they looked already patched, even though most were still running vulnerable code.

Here is the full picture of which versions are affected and which are fixed:

  • Free: vulnerable up to 5.4.4, fixed in 5.4.5
  • Premium (single site): vulnerable up to 13.0.3, fixed in 13.0.4
  • Standard (single site): vulnerable up to 17.0.5, fixed in 17.0.6
  • Premium/Enterprise/All-Inclusive (multisite): vulnerable up to 20.2.7, fixed in 20.2.8
  • Enterprise/All-Inclusive (single site): vulnerable up to 26.0.2, fixed in 26.0.3
  • VIP (single site): vulnerable up to 32.0.7, fixed in 32.0.8
  • VIP (multisite): vulnerable up to 35.0.6, fixed in 35.0.7

What to do

If your site uses miniOrange SAML 2.0 Single Sign On for login, check which edition and version you’re running against the table above.

  1. If you’re below the fixed version for your edition, update immediately. Because paid editions jump version ranges that your WordPress dashboard may not flag as an update, you may need to download the patched version directly from your miniOrange account and upload it manually.
  2. If you can’t update right away, Patchstack’s writeup includes two narrowly-scoped code hotfixes you can apply in the meantime.
  3. Check your site’s login logs for administrator sessions starting from IP addresses you don’t recognize, especially any activity since mid-July 2026, when the flaws were first disclosed.

Both CVEs were fixed by the vendor, and the full version matrix was added to vulnerability databases on August 18, 2026. If you run any paid edition of this plugin, don’t assume you’re safe just because your version number looks recent.

End of article