Overview
- Two linked authentication-bypass flaws, CVE-2026-61979 and CVE-2026-15981, let an attacker submit a crafted SAMLResponse that the plugin accepts as valid and then set a WordPress auth cookie for any account.
- CVE-2026-61979 forces the plugin to honor the incoming SAML signature algorithm so an attacker can pick HMAC-SHA1 and use the IdP’s public RSA key as a known shared secret to forge signatures.
- CVE-2026-15981 treats an OpenSSL error return value (-1) as a successful verification, allowing malformed signatures to pass and letting the plugin call wp_set_auth_cookie() for the targeted user.
- Patchstack reported that a chained attack produced an admin session cookie that DigitalOcean blocked on August 16, and security researchers have observed opportunistic scans and exploitation attempts from multiple IPs.
- miniOrange/Xecurify has released patched builds for the free and all paid editions; site owners must manually install the listed patched versions, check admin sessions and logs for suspicious access, and rotate credentials if compromise is suspected.