miniOrange SAML Signature Bypass CVEs Enable Active WordPress Admin Cookie Theft

The flaws center on mo_saml_validate_signature performing a loose boolean check on the tri-state integer from openssl_verify. CVE-2026-15981 (CVSS 9.8) accepts the -1 error state as success while CVE-2026-61979 (CVSS 8.1) allows algorithm confusion. DigitalOcean observed an external admin session attempt outside their trusted network, prompting Patchstack disclosure. Scanning originates from six IPs including 207.211.214.41 and 162.243.116.148, indicating broad opportunistic probing rather than targeted selection of plugin editions or versions.

Technical evidence shows the PoC crafts a SAMLResponse with attacker-controlled NameID and deliberately invalid signature bytes. The plugin calls wp_set_auth_cookie without further checks once the malformed signature passes the boolean gate. This pattern matches prior SSO plugin failures where cryptographic verification was reduced to a single loose return-value test. Procurement records and job postings from identity providers reveal repeated under-investment in edge-case signature handling across multiple vendors.

Original coverage understates the supply-chain risk: miniOrange is used by organizations relying on external identity providers, so a single plugin compromise can pivot into federated environments. The spread across unrelated IPs and lack of targeting suggests commodity exploit kits will incorporate the PoC within weeks. No independent technical attribution ties the scanning to any specific actor beyond the observed infrastructure.

Sites must upgrade to 17.0.6 immediately and audit recent admin sessions for unexpected cookies. Operators should also monitor for follow-on exploitation of the newly obtained administrative access, as the initial bypass grants a foothold but not necessarily persistence.