Serious Threat Emerges for WordPress Users
Recent findings reveal that malicious entities are exploiting two critical unauthenticated authentication bypass vulnerabilities present in the Xecurify miniOrange SAML 2.0 Single Sign-On plugin.
These flaws potentially grant attackers the capability to log in as any WordPress user, including those with administrative privileges.
The vulnerabilities have been detailed by Patchstack and are as follows:
- CVE-2026-61979 (CVSS score: 8.1) – A vulnerability enabling unauthenticated privilege escalation due to signature algorithm confusion; this issue has been rectified in version 17.0.5 for the Standard edition.
- CVE-2026-15981 (CVSS score: 9.8) – An authentication bypass vulnerability that arises from the acceptance of malformed signatures as legitimate; this has been addressed in version 17.0.6 for the Standard edition.
According to a description of CVE-2026-15981 provided on CVE.org, “The issue lies within the mo_saml_validate_signature() function, which performs a lenient boolean assessment of the raw tri-state integer returned by PHP’s openssl_verify().
This misconfiguration causes an erroneous return value of -1 to be mistakenly interpreted as valid, leading to a successful signature verification.
Consequently, this exploitation enables unauthenticated attackers to gain access as any existing WordPress user, including administrators, by sending a specially crafted SAMLResponse featuring an attacker-modified NameID alongside a deliberately malformed signature.
This triggers an OpenSSL processing error, completely circumventing the verification process, which culminates in the invocation of wp_set_auth_cookie() for the targeted account.
The WordPress security firm, having acknowledged the DigitalOcean security team for their contributions in identifying these issues, elucidated that an attacker can construct a SAML response with an invalid signature and submit it to the plugin, prompting the plugin to erroneously consider it valid.
Remarkably, the cloud infrastructure provider unearthed these vulnerabilities following the detection of an unusual WordPress administrator session attempt originating beyond their secure network.
“The attacker had already leveraged the bypass to secure a WordPress admin session cookie, but faced obstruction because the administrative functions were restricted to their trusted network,” Patchstack reported.
Recordings of scanning activities have been traced back to the following IP addresses:
- 207.211.214.41
- 79.127.224.14
- 102.91.71.83
- 162.243.116.148
- 84.201.6.54
- 64.225.25.188
“This pattern indicates an opportunistic scanning approach as opposed to a targeted offensive,” Patchstack further elaborated.
“The perpetrator seems to be indiscriminately deploying the exploit across all sites utilizing the plugin, without verification of the specific edition or version involved.”
WordPress site administrators are strongly advised to implement the most recent fixes to fortify their defenses, particularly in light of the existence of proof-of-concept (PoC) code that enables assailants to exploit these vulnerabilities.
This could permit them to exploit the flaws, thereby acquiring administrative privileges and potentially taking control of vulnerable sites.
Source link: Thehackernews.com.
