Security researchers and hosting providers reported on August 25, 2026 that attackers are actively exploiting two previously disclosed vulnerabilities in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress, a widely used plugin from Xecurify that lets sites offload authentication to an external identity provider. The two flaws being exploited in the wild are CVE-2026-61979, a privilege-escalation bug caused by signature-algorithm confusion, and CVE-2026-15981, a more severe authentication bypass with a CVSS score of 9.8 that stems from the plugin accepting malformed SAML signatures as valid; together they let an attacker sign in as any user on the site, including full administrators, without needing any legitimate credentials at all. What makes this campaign noteworthy for people running WordPress infrastructure isn't just the severity but the scope of confusion around which builds are actually vulnerable: researchers found that miniOrange ships the same underlying plugin code across seven different editions and pricing tiers under a single marketplace slug, and six of those paid editions had never been individually listed in standard vulnerability databases, meaning a site operator running a paid tier could easily have missed the disclosure entirely even while watching CVE feeds closely. DigitalOcean's infrastructure team first flagged anomalous authentication patterns on August 16 that traced back to active exploitation of the free edition specifically, and the attacks have continued and broadened since. The vendor has shipped fixes, version 17.0.5 for the CVSS 8.1 issue and 17.0.6 for the CVSS 9.8 bypass in the Standard edition, but because of the edition-sprawl problem, anyone running any miniOrange SAML SSO variant should verify their specific build against the patched version numbers directly with the vendor rather than assuming a generic plugin-is-up-to-date check catches it, and should treat any WordPress site using SAML-based SSO as worth an immediate admin-account audit given how long the bypass has apparently been exploitable before broad detection.