Blog miniOrange SAML SSO 5.4.5 stops an unauthenticated admin login
miniOrange SAML SSO 5.4.5 stops an unauthenticated admin login
A loose boolean check in miniOrange SAML SSO let anyone sign in as an admin, and 5.4.5 fixes it. Other fixes cover a WooCommerce OTP token leak, a WPeMatico privilege escalation, an unauth RCE in a Contact Form 7 uploader, XSS in WPForms Pro, and a Dokan capability slip.
Six plugin advisories share one shape: a check that trusts the wrong value. One plugin’s signature check accepts an error as a valid signature. Another returns a login token in a public response. A third strips characters from an uploaded filename and checks the wrong string. Any one of these lets a stranger act as a real user. In three cases that user is an admin.
miniOrange SAML SSO is the most serious of them. The plugin’s signature check ran a loose boolean test on the tri-state integer returned by openssl_verify(). That function returns -1 on error, and -1 is truthy, so an error was read as a valid signature. Any SAML response passed, and any SAML response can name any user. Version 5.4.5 fixes it.
miniorange-saml-20-single-sign-on 5.4.5
Two CVEs come out of this plugin. The critical one is CVE-2026-15981, an unauthenticated authentication bypass with a CVSS of 9.8. The other, CVE-2026-61979, is an unauthenticated privilege escalation at 8.1. Both fall to the same root cause and both are fixed in one release.
- Affected: all versions up to and including 5.4.4
CVE-2026-15981, CVSS 9.8 — auth bypass (unauth)- CVE-2026-61979, CVSS 8.1 — privilege escalation (unauth)
- Patched in 5.4.5
- After updating, check the users table for accounts you did not create, and rotate application passwords for any admin
automation-web-platform-notifications-and-otp-for-woocommerce up to 4.8.6, unpatched
The plugin’s handle_email_otp_return() returns the secret magic login token in the response body of a public OTP request. The token is meant to reach the user by email only. An unauthenticated request can read it and use it to sign in as the account owner.
- Affected: all versions up to and including 4.8.6
- CVE-2026-77264, CVSS 9.8 — auth bypass (unauth)
- No fixed version at the time of writing
- If you run this plugin on a store, disable it until a patch is available
drag-and-drop-multiple-file-upload-for-contact-form-7 1.3.9.9
The plugin strips characters from an uploaded filename. It then checks the extension of the original string, not the final one. An unauthenticated request can pick a filename that passes the check but writes as a PHP file. That is remote code execution.
- Affected: all versions before 1.3.9.9
- CVE-2026-18781, CVSS 8.1 — RCE (unauth)
- Patched in 1.3.9.9
- After updating, look in the plugin’s upload directory for
.php,.phtmlor.pharfiles that do not belong there
wpematico-rss-feed-fetcher up to 2.8.24, unpatched
The wpematico_import_settings function has no capability check. A subscriber can call it and update any WordPress option. From there, an attacker can flip users_can_register on and set default_role to administrator. Then they register a new admin account through the normal registration form.
- Affected: all versions up to and including 2.8.24
- CVE-2026-19883, CVSS 8.8 — privilege escalation (subscriber and above)
- No fixed version at the time of writing
- Close open registration and audit the users table if this plugin has been active with subscriber accounts
dokan 5.0.14
Several admin REST routes checked only for a WooCommerce management capability, not for a Dokan install capability. A Shop Manager could reach the plugin-install route and add a plugin of their choice. A plugin can run any code.
- Affected: all versions before 5.0.14
- CVE-2026-16576, CVSS 7.2 — privilege escalation (Shop Manager and above)
- Patched in 5.0.14
- After updating, review installed plugins for any you did not add
wpforms-pro up to 2.0.0.2, unpatched
Single Line Text and Paragraph Text field values are not sanitized on input. They are not escaped on output either. An unauthenticated visitor can submit a form entry that carries JavaScript. The script fires whenever an admin opens the entry in the dashboard.
- Affected: all versions up to and including 2.0.0.2
- CVE-2026-18409, CVSS 7.2 — stored XSS (unauth)
- No fixed version at the time of writing
- Review recent form entries for script tags before opening them in the admin
Tags: #wordpress , #plugin , #cve , #exploit