Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
- ID
- 17560
- Status
- summarized
- Published
- 25 Aug 2026, 4:34 PM
- Fetched
- 25 Aug 2026, 6:33 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/attackers-target-miniorange-saml-flaws.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 25 Aug 2026, 6:34 PM
- Tags
- Audience
- developerssaas_founders
What happened
Two unauthenticated authentication bypass vulnerabilities (CVE-2026-15981 CVSS 9.8 and CVE-2026-61979 CVSS 8.1) in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin allow attackers to log in as any user, including admins. The root cause is a loose boolean check on PHP's openssl_verify(), which returns -1 on error but was treated as truthy (valid). Both are fixed in plugin versions 17.0.5 and 17.0.6 respectively, and active opportunistic scanning from six IP addresses is already underway.
Why it matters
If you run WordPress with the miniOrange SAML plugin below version 17.0.6, patch immediately—attackers are actively scanning for this and can get full admin access without credentials. Beyond patching, the openssl_verify() tri-state return value (-1, 0, 1) being loosely compared as boolean is a PHP gotcha worth auditing in any SAML or crypto verification code you maintain.
Discussion angle
The openssl_verify() loose comparison bug is a classic PHP footgun—walk through how a tri-state integer return (-1/0/1) gets silently coerced into a boolean, and why strict comparison (=== 1) matters in any signature verification or crypto validation code your team writes.