If your WordPress site uses a miniOrange single sign-on plugin, check it today. A critical flaw was patched back in July, and attackers are still breaking into sites with it. The reason is uncomfortable: for most people, the version number in their dashboard does not tell them whether they are safe.
What the flaw does
Single sign-on lets you log in to a site using another account, like your work login. The miniOrange SAML plugin checks a signed message to confirm you are who you claim to be.
Two bugs, chained together, break that check completely:
- CVE-2026-61979 lets an attacker choose a weak signing method and forge a signature using information that is already public.
- CVE-2026-15981 is worse. When the security check fails with an error, the plugin treats that error as a pass.
Put together, someone with no account and no password can forge a login and land in your admin dashboard as any user on the site. Both are rated 9.8 out of 10 for severity. That is about as bad as a web vulnerability gets.
Two related miniOrange flaws are also worth knowing about: CVE-2026-57807 in the OAuth SSO plugin, which abuses password recovery to hand over an admin session and affects every version up to and including 38.5.8, and CVE-2026-14300 in miniOrange Social Login.
Why it is still being exploited a month after the fix
Here is the part that catches people out, and it has nothing to do with anyone being careless.
The plugin ships in seven editions. They share one codebase and one bug — but each edition has its own, completely unrelated version numbering. When the fix went out, the public advisory named only the free edition’s patched version: 5.4.5.
So if you are a paying customer running Premium 13.0.3, you read an advisory telling you to get to 5.4.5, glance at your dashboard, see a much higher number, and reasonably conclude you are fine.
You are not. Here is the real picture:
| Edition | Vulnerable up to | Safe from |
|---|---|---|
| Free | 5.4.4 | 5.4.5 |
| Premium | 13.0.3 | 13.0.4 |
| Standard | 17.0.5 | 17.0.6 |
| Premium / Enterprise Multisite | 20.2.7 | 20.2.8 |
| Enterprise / All-Inclusive | 26.0.2 | 26.0.3 |
| VIP (single site) | 32.0.7 | 32.0.8 |
| VIP (multisite) | 35.0.6 | 35.0.7 |
A version number alone cannot answer this question. You need the edition too.
How to check your site in two minutes
- Sign in to WordPress and open Plugins.
- Look for anything starting with miniOrange. If there is nothing, you are not affected by this one — you can stop here.
- If you do have it, note both the edition and the version, then compare against the table above.
- Update it. If you are on a paid edition and no update appears, contact miniOrange directly for your edition’s build.
Worth doing even if you are already patched: check Users for administrator accounts you do not recognise, and look for admin logins from unexpected locations. Security researchers have observed scanning from Belgium, Nigeria, the United States and Germany probing for these endpoints.
The wider lesson: “up to date” is not the same as “safe”
Most WordPress advice reduces to “keep everything updated.” That is good advice and it is not enough. This case shows two ways it quietly fails:
- Paid plugins often update outside WordPress. Commercial editions frequently do not appear in the normal update screen, so the one place most people look never shows a problem.
- An advisory can be technically true and still misleading. Naming one edition’s version number was accurate. It also left the majority of paying users with no way to recognise themselves in it.
If you run plugins that handle logins, payments or customer data, it is worth writing down which ones are commercial, where their updates actually come from, and who is responsible for applying them.
Where Canadian Web Hosting customers stand
We checked our own platform as soon as this surfaced.
Managed WordPress: not affected. We audited every site on the platform three ways — installed plugins, files on disk, and database records. No miniOrange plugin is present on any of them. Managed WordPress ships a fixed, curated plugin set, so single sign-on plugins are not part of the platform.
Shared and reseller hosting: you install and manage your own plugins there, so please run the two-minute check above. Our technical team is reviewing the fleet as well, and we will contact you directly if we find an affected install on your account.
If you are unsure what you are running, or you would like us to look at your site with you, open a ticket and we will help. If you think a site may already have been compromised, say so when you contact us and we will treat it as urgent.
Sources: Patchstack, BleepingComputer, The Hacker News. Version details accurate as of publication.
Be First to Comment