Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Attackers are actively exploiting two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign On WordPress plugin, allowing unauthenticated users to bypass authentication entirely by submitting crafted SAML responses with malformed signatures. The root cause lies in inadequate validation of SAML assertion signatures, a fundamental flaw in authentication logic that should never reach production. This is particularly dangerous because SAML is explicitly designed to be a trust mechanism — when that trust layer is bypassed, attackers inherit full administrative privileges with no credentials required. The active exploitation by opportunistic scanners means unpatched sites are being compromised at scale, highlighting the urgency of timely plugin updates and continuous vulnerability monitoring.