[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYbjeCfU3DlrpT_iMP1J-PyiKb12YucL0tf-iz8rFd3E":3},{"article":4,"iocs":49,"watch_terms":60,"solutions":61,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"8b488dfe-1bcf-4fa1-b898-c0287a3aeaa8","Hackers target WordPress sites in miniOrange auth bypass attacks","hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks-ab19b1","Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators. [...]","Hackers are actively exploiting two critical authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. These flaws allow attackers to forge SAML responses and gain administrator access. While fixes were released in July, the vendor's advisory only covered the free edition, leaving many paid editions unpatched and vulnerable to exploitation.","Hackers exploit two critical auth bypass flaws in miniOrange SAML SSO WordPress plugin.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F24\u002Fminiorange.jpg","2026-08-24T19:26:32+00:00","2026-08-24T20:00:08.539075+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"SAML 2.0 Single Sign On plugin","product",{"name":21,"type":22},"miniOrange","vendor",{"name":24,"type":22},"Xecurify",{"name":26,"type":19},"WordPress",{"name":28,"type":19},"Microsoft Entra ID",{"name":30,"type":19},"Okta","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,56],{"type":51,"value":52,"context":53},"cve","CVE-2026-61979","Authentication bypass vulnerability in miniOrange SAML SSO plugin.",{"type":51,"value":55,"context":53},"CVE-2026-15981",{"type":57,"value":58,"context":59},"ip","192.168.1.1","IP address used in exploitation attempts (example, actual IPs not provided in article).",[21,24,18],{"controls":62,"vendors":146},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":93,"name":94,"problem":95,"products":96},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":122,"name":123,"problem":124,"products":125},"patch-management","Automated patch management","Known holes get closed in days, not months.",[126,130,138],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":122,"product_name":127,"url":128,"description":129},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":163},"miniorange-saml-plugin-auth-bypass-exposes-wordpress-admin-access","miniOrange SAML Plugin Auth Bypass Exposes WordPress Admin Access","Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On WordPress plugin are being actively exploited, allowing attackers to forge SAML responses and seize full administrator control. The vendor released patches in July but only disclosed and fixed the free edition, leaving paid-tier users exposed without clear guidance — a dangerous gap in vendor patch communication. This highlights how incomplete or edition-scoped patching can create a false sense of security for paying customers who may assume they are protected. The consequences of admin-level compromise on WordPress sites include full content manipulation, malware injection, credential harvesting, and supply chain attacks targeting site visitors.",[152,153,154,155,156,157,158,159,160,161,162],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 5: Account Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 IA-8: Identification and Authentication (Non-Organizational Users)","NIST CSF ID.AM-2: Software platforms and applications within the organization are inventoried","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","OWASP A07:2021 – Identification and Authentication Failures","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (where EU user data is at risk)",{}]