Blog miniOrange SAML SSO auth bypass moves from advisory to attack

miniOrange SAML SSO auth bypass moves from advisory to attack

Attackers are now targeting WordPress sites that still run miniOrange SAML SSO 5.4.4 or older. Five more plugin CVEs also arrived, four of them without a fix.

Segurium 3 min read
  • wordpress
  • plugin
  • cve
  • exploit

The miniOrange SAML SSO bug we wrote about on Saturday is no longer just theory. Attackers are now hitting WordPress sites that still run 5.4.4 or older. The fix is still miniorange-saml-20-single-sign-on 5.4.5, and sites on that release or later are safe.

The pattern today: five other advisories arrived on NVD, four of them without a patched version yet. Owners of those plugins need to lower attacker access until fixes ship.

miniorange-saml-20-single-sign-on 5.4.5

The bug is in mo_saml_validate_signature(). It uses a loose boolean check on the return value of PHP’s openssl_verify(). That call has three possible returns: 1, 0, or -1. The -1 means an error, but a loose check reads it as truthy. So a malformed signature passes as valid, and the attacker logs in as any user, including admin. No account, no password, no click.

Sites still on 5.4.4 or older should assume attackers have tried them.

  • Affected: all versions up to and including 5.4.4
  • CVE: CVE-2026-15981, CVSS 9.8
  • Also confirmed: CVE-2026-61979, CVSS 8.1, an earlier priv-esc through 5.4.3
  • Patched: 5.4.5
  • Installed on ~10,000 sites
  • Update to 5.4.5 or later. Then check wp_users for accounts you did not create, and audit recent admin logins.

wp-wc-affiliate-program up to 8.9.1, unpatched

An unauthenticated attacker can escalate to a higher role on Affiliate Pro for WooCommerce & WordPress. NVD lists no fixed version yet.

  • Affected: all versions up to and including 8.9.1
  • CVE: CVE-2026-32558, CVSS 9.8
  • No install count is published for this plugin
  • Deactivate until the vendor ships a fix

advanced-custom-post-type up to 2.0.63, unpatched

ACPT (Pro) accepts a subscriber-controlled serialized string that reaches unserialize(). That gives PHP object injection. The attacker builds a chain of magic methods that runs code when the object is destroyed. A subscriber account is enough.

  • Affected: all versions up to and including 2.0.63
  • CVE: CVE-2026-32563, CVSS 9.8
  • No install count is published for this plugin
  • Close open registration until a fix ships, and audit accounts with the subscriber role

magicai-wp up to 1.4, unpatched

A subscriber-level user can read local files through a path parameter that is not properly restricted. That exposes wp-config.php and any secret the web user can read.

  • Affected: all versions up to and including 1.4
  • CVE: CVE-2026-32560, CVSS 8.8
  • No install count is published for this plugin
  • Close subscriber registration. If you cannot, rotate database and auth-key secrets.

notification-master up to 1.7.1, unpatched

An unauthenticated request reaches an action that should require a capability check. The current directory version is 1.7.1, which is also the affected ceiling. No fix is out yet.

  • Affected: all versions up to and including 1.7.1
  • CVE: CVE-2026-28153, CVSS 7.5
  • Installed on ~1,000 sites
  • Deactivate until 1.7.2 or later ships

events-manager 7.4.1

Events Manager does not check whether the caller is allowed to view an event. So an unauthenticated user can read titles, dates, descriptions and location details of draft and private events. No writes and no takeover. If you use the plugin to schedule private venues, the schedule is public.

  • Affected: all versions up to and including 7.4.0
  • CVE: CVE-2026-10627, CVSS 5.3
  • Patched: 7.4.1
  • Installed on ~70,000 sites

Four of today’s six advisories have no patched version yet, so the short-term work is scanning for signs the flaws have already been used.

Related