Attackers Target mini Orange SAML Flaws That Can Grant Word Press Admin Access
Summary: Attackers are attempting to exploit two unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that let an attacker sign in as any WordPress user, including administrators. Patchstack traced the flaw to the mo_saml_validate_signature() function treating PHP's openssl_verify() error return of -1 as a successful signature check, and said the DigitalOcean security team found it after observing an anomalous WordPress administrator session attempt from outside their trusted network.
What's compelling: A malformed signature value is enough to trigger wp_set_auth_cookie() for a targeted admin account, and proof-of-concept code that chains the flaws to take over sites is already available while scanning spreads across IPs indiscriminately.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-15981
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026