Overview
- Two linked authentication‑bypass vulnerabilities, tracked as CVE‑2026‑61979 and CVE‑2026‑15981, let an attacker submit a forged SAMLResponse and sign in as any WordPress user including administrators.
- The bugs work because the plugin accepts the signature algorithm declared in incoming SAML responses and can be forced to treat an IdP RSA public key as an HMAC secret, while an openssl_verify() error result of -1 is treated as success, allowing malformed signatures to pass.
- DigitalOcean detected and blocked an anomalous WordPress admin session that used the chain of flaws to obtain an admin session cookie on August 16, 2026, demonstrating practical exploitability in the wild.
- Security researchers report active opportunistic scanning from multiple IPs and a public proof‑of‑concept for the free edition, and they warn attacks will rise until site owners confirm and apply the correct patched versions.
- Vendor patches exist for all editions but the public advisory emphasized only the free build so paid and enterprise customers must check their edition and manually upgrade to the vendor‑listed fixed versions to fully mitigate risk; roughly 40,000 total installations are potentially exposed.