VulnerabilityBleeping Computer
9.8 — CRITICAL
Hackers target WordPress sites in miniOrange auth bypass attacks
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Hackers are exploiting two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing them to forge SAML responses and gain admin access. The vulnerabilities were publicly disclosed and fixed in July, but the vendor's advisory only covered the free edition, leaving paid editions vulnerable.
⚙️Technical Details
CVEs
CVE-2026-61979CVE-2026-15981Affected Systems: miniOrange SAML SSO plugin for WordPressAttack Vectors: NETWORK
Affected Systems
miniOrange SAML SSO plugin for WordPress
Attack Vectors
NETWORK
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
WordPress site administrators using the miniOrange SAML SSO plugin, particularly those running paid editions without an alert.
🛡️Recommended Actions
1Immediately upgrade to a patched release of the miniOrange SAML SSO plugin
2Enable two-factor authentication for WordPress administrator accounts
3Monitor website logs for suspicious activity and block any anomalous sessions
📦Affected Products
Product Name: miniOrange SAML SSO plugin for WordPressVersion Range: <= 5.4.3 (free edition), <= 5.4.4 (paid editions)
🔐NVD Verified DataVERIFIED
CVE-2026-61979 ↗CVSS 8.1 — HIGH
Attack Vector
NETWORK
Complexity
HIGH
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-266
CVE-2026-15981 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-287
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.