Blog miniOrange SAML SSO auth bypass moves from advisory to attack
miniOrange SAML SSO auth bypass moves from advisory to attack
Attackers are now targeting WordPress sites that still run miniOrange SAML SSO 5.4.4 or older. Five more plugin CVEs also arrived, four of them without a fix.
The miniOrange SAML SSO bug we wrote about on Saturday is no longer just theory. Attackers are now hitting WordPress sites that still run 5.4.4 or older. The fix is still miniorange-saml-20-single-sign-on 5.4.5, and sites on that release or later are safe.
The pattern today: five other advisories arrived on NVD, four of them without a patched version yet. Owners of those plugins need to lower attacker access until fixes ship.
miniorange-saml-20-single-sign-on 5.4.5
The bug is in mo_saml_validate_signature(). It uses a loose boolean check on the return value of PHP’s openssl_verify(). That call has three possible returns: 1, 0, or -1. The -1 means an error, but a loose check reads it as truthy. So a malformed signature passes as valid, and the attacker logs in as any user, including admin. No account, no password, no click.
Sites still on 5.4.4 or older should assume attackers have tried them.
- Affected: all versions up to and including 5.4.4
- CVE: CVE-2026-15981, CVSS 9.8
- Also confirmed:
CVE-2026-61979, CVSS 8.1, an earlier priv-esc through 5.4.3 - Patched: 5.4.5
- Installed on ~10,000 sites
- Update to 5.4.5 or later. Then check
wp_usersfor accounts you did not create, and audit recent admin logins.
wp-wc-affiliate-program up to 8.9.1, unpatched
An unauthenticated attacker can escalate to a higher role on Affiliate Pro for WooCommerce & WordPress. NVD lists no fixed version yet.
- Affected: all versions up to and including 8.9.1
- CVE: CVE-2026-32558, CVSS 9.8
- No install count is published for this plugin
- Deactivate until the vendor ships a fix
advanced-custom-post-type up to 2.0.63, unpatched
ACPT (Pro) accepts a subscriber-controlled serialized string that reaches unserialize(). That gives PHP object injection. The attacker builds a chain of magic methods that runs code when the object is destroyed. A subscriber account is enough.
- Affected: all versions up to and including 2.0.63
- CVE: CVE-2026-32563, CVSS 9.8
- No install count is published for this plugin
- Close open registration until a fix ships, and audit accounts with the subscriber role
magicai-wp up to 1.4, unpatched
A subscriber-level user can read local files through a path parameter that is not properly restricted. That exposes wp-config.php and any secret the web user can read.
- Affected: all versions up to and including 1.4
- CVE: CVE-2026-32560, CVSS 8.8
- No install count is published for this plugin
- Close subscriber registration. If you cannot, rotate database and auth-key secrets.
notification-master up to 1.7.1, unpatched
An unauthenticated request reaches an action that should require a capability check. The current directory version is 1.7.1, which is also the affected ceiling. No fix is out yet.
- Affected: all versions up to and including 1.7.1
- CVE: CVE-2026-28153, CVSS 7.5
- Installed on ~1,000 sites
- Deactivate until 1.7.2 or later ships
events-manager 7.4.1
Events Manager does not check whether the caller is allowed to view an event. So an unauthenticated user can read titles, dates, descriptions and location details of draft and private events. No writes and no takeover. If you use the plugin to schedule private venues, the schedule is public.
- Affected: all versions up to and including 7.4.0
- CVE: CVE-2026-10627, CVSS 5.3
- Patched: 7.4.1
- Installed on ~70,000 sites
Four of today’s six advisories have no patched version yet, so the short-term work is scanning for signs the flaws have already been used.
Tags: #wordpress , #plugin , #cve , #exploit