Hackers target WordPress sites in miniOrange auth bypass attacks

Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On WordPress plugin are being actively exploited, allowing attackers to forge SAML responses and seize full administrator control. The vendor released patches in July but only disclosed and fixed the free edition, leaving paid-tier users exposed without clear guidance — a dangerous gap in vendor patch communication. This highlights how incomplete or edition-scoped patching can create a false sense of security for paying customers who may assume they are protected. The consequences of admin-level compromise on WordPress sites include full content manipulation, malware injection, credential harvesting, and supply chain attacks targeting site visitors.