[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5b1q_d3pAZhOhyJkHJOSkinn6yQmIDJi-gAbOanFB0g":3},{"article":4,"iocs":38,"watch_terms":60,"solutions":61,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"170e1155-bdc6-4a2d-b84c-f48b89c16ca5","Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access","attackers-target-miniorange-saml-flaws-that-can-grant-wordpress-admin-access-91c617","Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators. The vulnerabilities, as disclosed by Patchstack, are listed below - CVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation","Attackers are actively exploiting two critical vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress. These flaws allow unauthenticated attackers to bypass authentication and gain administrative access by submitting crafted SAML responses with malformed signatures. The vulnerabilities have been exploited by opportunistic scanners, and WordPress site owners are urged to update the plugin immediately.","Attackers exploit miniOrange SAML plugin flaws for WordPress admin access.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fattackers-target-miniorange-saml-flaws.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhtxn6tX1r1BmVfN_4cdoh6p5jmcAe3D9ckNhjscacXx5HpxZJAdb1SvIWo404cGlwahzCLyFIRB-MdUjGcQdBLLC5pMwaCB75e9AT5jKvC49cvIP5jGIOB4IjcQGaOpibWbIPKj929DICeMilGRZn5JmVIcVslRm2hWgz5RTXIZK5d2b2N5dlEnRBBwWVO\u002Fs1600\u002Fwordpress-hack.jpg","2026-08-25T08:34:07+00:00","2026-08-25T10:00:05.694808+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"miniOrange SAML 2.0 Single Sign On plugin","product",{"name":21,"type":22},"Xecurify","vendor",{"name":24,"type":25},"WordPress","technology",{"name":27,"type":19},"SAML",{"name":29,"type":22},"Patchstack","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},[39,43,46,50,52,54,56,58],{"type":40,"value":41,"context":42},"cve","CVE-2026-61979","Unauthenticated privilege escalation vulnerability",{"type":40,"value":44,"context":45},"CVE-2026-15981","Authentication bypass vulnerability",{"type":47,"value":48,"context":49},"ip","207.211.214.41","Scanning IP address",{"type":47,"value":51,"context":49},"79.127.224.14",{"type":47,"value":53,"context":49},"102.91.71.83",{"type":47,"value":55,"context":49},"162.243.116.148",{"type":47,"value":57,"context":49},"84.201.6.54",{"type":47,"value":59,"context":49},"64.225.25.188",[21,29,18],{"controls":62,"vendors":147},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":93,"name":94,"problem":95,"products":96},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":122,"name":123,"problem":124,"products":125},"patch-management","Automated patch management","Known holes get closed in days, not months.",[126,131,139],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":127,"product_name":128,"url":129,"description":130},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":162},"critical-wordpress-saml-plugin-flaws-enable-unauthenticated-admin-takeover","Critical WordPress SAML Plugin Flaws Enable Unauthenticated Admin Takeover","Attackers are actively exploiting two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign On WordPress plugin, allowing unauthenticated users to bypass authentication entirely by submitting crafted SAML responses with malformed signatures. The root cause lies in inadequate validation of SAML assertion signatures, a fundamental flaw in authentication logic that should never reach production. This is particularly dangerous because SAML is explicitly designed to be a trust mechanism — when that trust layer is bypassed, attackers inherit full administrative privileges with no credentials required. The active exploitation by opportunistic scanners means unpatched sites are being compromised at scale, highlighting the urgency of timely plugin updates and continuous vulnerability monitoring.",[153,154,155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","CIS Control 5: Account Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 IA-8: Identification and Authentication (Non-Organizational Users)","NIST SP 800-53 AC-6: Least Privilege","NIST CSF ID.RA-1: Asset Vulnerabilities are Identified and Documented","OWASP A07:2021 – Identification and Authentication Failures","GDPR Article 32: Security of Processing (for EU-hosted sites storing personal data)",{}]