WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
WordPress websites are targeted by attackers exploiting two critical authentication bypass vulnerabilities in the
Threat actors are actively exploiting two critical authentication bypass vulnerabilities, CVE-2026-61979 and CVE-2026-15981, in the MiniOrange SAML 2.0 Single Sign-On (SSO) plugin for WordPress. These flaws allow attackers to log in as any user, including administrators. While patches exist, the developer's lack of clear communication, especially for paid versions, leaves many users unaware and vulnerable to these opportunistic attacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run MiniOrange?
Get an email when a new story names MiniOrange, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTwo critical authentication bypass vulnerabilities in the MiniOrange SAML 2.0 SSO plugin allow attackers to log in as any user — including administrators — without valid credentials, effectively handing over full site control. The root cause lies in inadequate input validation or improper enforcement of authentication logic within the plugin's SSO flow. Compounding the technical flaw, the developer's poor communication around patch availability — particularly for paid license holders — left a significant portion of the user base unaware that a critical fix even existed. This highlights a dangerous gap where a patch exists but fails to reach affected users due to weak disclosure and update notification practices. Authentication bypass vulnerabilities are especially severe because they negate all downstream access controls, making rapid patching and proactive monitoring non-negotiable.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-61979
- cve — CVE-2026-15981