Critical Authentication Bypass in miniOrange SAML SSO Plugin

Two critical vulnerabilities (CVSS 9.8) in the miniOrange SAML 2.0 Single Sign On plugin for WordPress are currently being exploited in the wild. Chaining CVE-2026-61979 and CVE-2026-15981 allows unauthenticated attackers to forge SAML assertions and obtain administrative sessions without valid credentials.

A significant remediation gap exists because the plugin's seven different editions use independent versioning under a single WordPress slug. Many vulnerability scanners and the WordPress dashboard fail to alert users of paid editions (Premium, Standard, Enterprise, VIP) that they are vulnerable. DigitalOcean recently reported active exploitation attempts targeting these paid editions, which were previously overlooked by most security databases.