miniOrange SAML Single Sign On (WordPress): authentication bypass (CVE-2026-15981) reported exploited, fixed in 5.4.7
Published 05/11/2026 17:43 · Updated 05/11/2026 17:53 (revision 2)
Timeline
2 events over 3 d 16 h
- 02/11/2026First report+3 d 16 h
- 05/11/2026 17:43Published on WatchtowerPro CISO
In short
The miniOrange SAML Single Sign On plugin for WordPress has a flaw that lets an unauthenticated attacker get their own certificate trusted and then log in as any user, including an administrator. VulnCheck reports it is being exploited. Update to 5.4.7 or later. Shodan estimates about 1.5 million internet-facing WordPress servers worldwide, 270,403 of them in the EU (11/11/2026); how many run an affected version is not yet known. GreyNoise reports a public exploit for CVE-2026-19842 (08/11/2026).
How bad is it
Critical. An attacker on the internet may be able to log in to a WordPress site as another user, possibly an administrator, without a password, if the vulnerable SAML plugin is active.
Being exploited.
Severity score
CVSS 3.1 from NVD, from the vendor, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickYes
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: authentication bypass.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- miniOrange SAML Single Sign On plugin for WordPress: all versions up to and including 5.4.4 (CVE-2026-15981, unauthenticated authentication bypass via SAMLResponse parameter). VulnCheck's entry says the certificate-trust flaw affects versions before 5.4.7, so 5.4.5 and 5.4.6 may also be affected.
Fixed in
- Version 5.4.7 is the first release named as fixing the certificate-trust flaw (VulnCheck entry). The plugin changelog lists later security fixes up to 6.2.0.
What to do now
- Update the miniOrange SAML Single Sign On plugin (slug miniorange-saml-20-single-sign-on) to the latest release, at least 5.4.7; the changelog lists 6.2.0 as the latest seen.
- Check the vendor changelog on wordpress.org before updating.
- Review the plugin's trusted signing certificate and compare it with your identity provider's certificate. Check recent admin logins and look for unexpected admin accounts.
- If you cannot update, disable the plugin or SAML login. This reduces exposure but does not make the site safe if the plugin remains vulnerable elsewhere.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer, all 3 sources with their dates and every revision. And technology matching: which of your systems run WordPress, at which version, fixed or not - and what each one needs.
Main sources
Known exploited (VulnCheck KEV): - Improper Authentication Research · SAML Single Sign On Research · SAML Single Sign On Research
Data: Shodan - WordPress (estimate, 11/11/2026) · GreyNoise - CVE-2026-19842 (estimate, 08/11/2026)