miniOrange SAML 2.0 SSO — Unauthenticated Authentication Bypass
Critical auth bypass in miniOrange SAML 2.0 SSO for WordPress lets unauthenticated attackers sign in as any user including admins. Exploitation confirmed.
- Vendor
- Xecurify
- Product
- miniOrange SAML 2.0 Single Sign On
- CVSS
- 9.8
- EPSS (exploit probability)
- 2.4%
- Status
- exploited-in-wild
- Published
Is CVE-2026-15981 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-15981 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-21 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 2.4% (scored October 18, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
Unauthenticated authentication bypass in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The flaw allows an attacker without valid credentials to authenticate as any WordPress user — including administrators — through a logic error in the plugin’s SAML authentication flow.
Impact: Full WordPress administrative control. An attacker who signs in as an administrator can create additional rogue administrator accounts, install malicious plugins, and access the file system via the built-in theme/plugin editors.
Affected product: Xecurify’s miniOrange SAML 2.0 Single Sign On plugin for WordPress. Commonly deployed on corporate, educational, and government WordPress installations using SAML-based SSO. Consult the vendor advisory for affected version ranges.
Exploitation status: Active exploitation attempts confirmed. Attackers are targeting this CVE alongside CVE-2026-61979 (CVSS 8.1), a second authentication bypass in the same plugin.
Patch: Update the plugin via your WordPress dashboard (Plugins → Updates). If immediate update is not possible, deactivate the plugin until patching can be completed.
Post-patch steps: Audit administrator accounts for unfamiliar additions. Review recent admin-level login activity for signs of unauthorized access. Rotate credentials for any accounts that may have been exposed.
See full coverage: miniOrange SAML WordPress Flaws Under Active Exploit
Other Xecurify CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-61979 miniOrange SAML 2.0 SSO — Second Authentication Bypass (High)write-up | [ HIGH ] | 8.1 | 0.4% | — |
