Hackers target WordPress sites in miniOrange auth bypass attacks
8 Articles
8 Articles
Hackers target WordPress sites in miniOrange auth bypass attacks
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators.
securityweek.com
IT Security News - cybersecurity, infosecurity newsWordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin. The post WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities appeared first on SecurityWeek.
A critical flaw in the miniOrange SAML 2.0 Single Sign-On plugin places WordPress sites that use corporate authentication at risk of invasion. Two vulnerabilities, identified as CVE-2026-61979 and CVE-2026-15981, allow bypassing SAML signature validation mechanisms and, under certain conditions, make an unauthenticated attacker be treated as a legitimate user. The problem is especially serious because the plugin is used to integrate WordPress in…
Hackers Exploit Critical miniOrange SAML SSO Flaws to Hijack WordPress Admin Accounts
Two critical flaws in the miniOrange SAML 2.0 Single Sign-On plugin could allow unauthenticated attackers to log in to vulnerable WordPress sites as any existing user, including administrators. The flaws, tracked as CVE-2026-61979 and CVE-2026-15981, carry a CVSS score of 9.8 and have been linked to attempted exploitation activity in the wild. The vulnerabilities affect miniOrange’s SAML-based single sign-on software, which lets WordPress sites …
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators. The vulnerabilities, as disclosed by Patchstack, are listed below CVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation
New hack campaign against WordPress. This time, hackers use 2 faults present in the miniOrange SAML 2.0 Single Sign On plugin. This plugin is supposed to put in place an authentication and a mechanism of SSO avoiding entering the identifiers each time. The attack completely bypasses the mechanisms of the plugin! All WordPress sites using this plugin are potentially affected. The weakness comes from the SAML Assertion Consumer Service mechanism a…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
