[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu1Bcp5PF3rExuarESxzahKTq5jFHU3EIPw9mMbKlSio":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"de0bcb9e-2b81-402d-a09d-3f85b132ff35","WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities","wordpress-websites-targeted-via-miniorange-plugin-vulnerabilities-fd0726","CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin. The post WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities appeared first on SecurityWeek.","Threat actors are actively exploiting two critical authentication bypass vulnerabilities, CVE-2026-61979 and CVE-2026-15981, in the MiniOrange SAML 2.0 Single Sign-On (SSO) plugin for WordPress. These flaws allow attackers to log in as any user, including administrators. While patches exist, the developer's lack of clear communication, especially for paid versions, leaves many users unaware and vulnerable to these opportunistic attacks.","WordPress websites are targeted by attackers exploiting two critical authentication bypass vulnerabilities in the","https:\u002F\u002Fwww.securityweek.com\u002Fwordpress-websites-targeted-via-miniorange-plugin-vulnerabilities\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002FWordPress.jpeg","2026-08-25T13:33:12+00:00","2026-08-25T14:00:06.835548+00:00",8,[17,20,23],{"name":18,"type":19},"SAML 2.0 SSO plugin","product",{"name":21,"type":22},"MiniOrange","vendor",{"name":24,"type":25},"WordPress","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-61979","Authentication bypass vulnerability in MiniOrange SAML 2.0 SSO plugin",{"type":46,"value":50,"context":48},"CVE-2026-15981",[21,18],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":157},"miniorange-plugin-auth-bypass-exposes-wordpress-sites-to-admin-takeover","MiniOrange Plugin Auth Bypass Exposes WordPress Sites to Admin Takeover","Two critical authentication bypass vulnerabilities in the MiniOrange SAML 2.0 SSO plugin allow attackers to log in as any user — including administrators — without valid credentials, effectively handing over full site control. The root cause lies in inadequate input validation or improper enforcement of authentication logic within the plugin's SSO flow. Compounding the technical flaw, the developer's poor communication around patch availability — particularly for paid license holders — left a significant portion of the user base unaware that a critical fix even existed. This highlights a dangerous gap where a patch exists but fails to reach affected users due to weak disclosure and update notification practices. Authentication bypass vulnerabilities are especially severe because they negate all downstream access controls, making rapid patching and proactive monitoring non-negotiable.",[147,148,149,150,151,152,153,154,155,156],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 5: Account Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 IA-2: Identification and Authentication","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF PR.IP-12: A vulnerability management plan is developed and implemented","OWASP Top 10 A07:2021 – Identification and Authentication Failures","GDPR Article 32: Security of Processing (for EU-facing WordPress sites storing personal data)",{}]