Hackers are attempting to exploit two critical authentication-bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, according to BleepingComputer. The flaws can reportedly be chained to forge Security Assertion Markup Language responses and log in as site administrators. The plugin, created by Xecurify, turns a WordPress site into a SAML service provider. That lets users authenticate through corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin instead of maintaining separate WordPress credentials. BleepingComputer reports that miniOrange is a family of seven plugins, with the free version showing 10,000 downloads and the other six products serving 30,000 customers. The two vulnerabilities are tracked as CVE-2026-61979 and CVE-2026-15981. As described by BleepingComputer, CVE-2026-61979 stems from the plugin accepting the signature algorithm supplied in an incoming SAML response rather than enforcing the configured algorithm. An attacker can select HMAC-SHA1, causing the plugin to treat the identity provider’s RSA public key as a shared secret; because that public key is known, the attacker can create a signature the plugin accepts. The second issue, CVE-2026-15981, concerns signature validation. BleepingComputer reports that the plugin treats an OpenSSL verification error of -1 as a successful result, allowing malformed signatures to pass validation. In combination, the two issues can let attackers bypass authentication rather than merely probe for misconfiguration. According to security firm Patchstack, as cited by BleepingComputer, the vulnerabilities were publicly disclosed and fixed in July. Patchstack says the vendor advisory covered only the free edition, even though fixes were also provided for the six paid editions. That matters because site owners running paid versions may not have realized they needed to update. Patchstack also reports that WordPress administrator dashboards will not show update warnings for the paid versions, according to BleepingComputer. Site owners using those editions must manually upgrade to a patched release rather than relying on the normal WordPress update prompt. The exploitation activity is no longer theoretical, based on Patchstack’s account. BleepingComputer reports that on August 16, DigitalOcean blocked an anomalous WordPress administrator session originating outside its trusted network. The subsequent investigation found that attackers had chained the two flaws to obtain an administrator session cookie through the Standard edition plugin in version 16.1.9. Patchstack’s data shows exploitation attempts and opportunistic scanning from six IP addresses across Europe, Africa, and the United States, BleepingComputer reports. A public proof-of-concept exploit targeting the free edition is also available, which could increase the pace of attacks. Who benefits: Attackers benefit when paid-edition users miss manual updates or assume the July advisory applied only to the free version. Defenders benefit from treating all miniOrange SAML SSO editions as in scope for immediate version checks. Who's exposed: WordPress sites running affected miniOrange SAML SSO editions are exposed, especially paid-edition deployments that have not been manually upgraded. The provided reporting specifically names the Standard edition plugin version 16.1.9 in an investigated attack path.