Imagine logging into a WordPress site as an admin without a password—this is the reality for many sites using the miniOrange SAML 2.0 plugin, thanks to two severe vulnerabilities that are now under active attack.
The miniOrange SAML 2.0 Single Sign-On plugin, widely used for WordPress authentication, has been found to harbor two critical vulnerabilities that allow attackers to bypass authentication altogether. Discovered by Patchstack, these flaws—CVE-2026-61979 and another unnamed vulnerability—enable anyone to log in as any user, including those with administrative privileges, without needing valid credentials. With a CVSS score of 8.1, the first vulnerability is particularly alarming, as it allows unauthenticated privilege escalation.
The root cause of this issue lies in the way the miniOrange plugin handles authentication requests. By exploiting the plugin's failure to properly validate incoming requests, attackers can craft malicious requests that the system accepts as legitimate. This misconfiguration essentially opens the floodgates, allowing attackers to impersonate any user, including admins, and gain full control over the WordPress site. Once inside, they can manipulate content, steal sensitive data, or even install backdoors for future access.
What’s particularly notable here is the prevalence of such vulnerabilities in widely used plugins. The miniOrange SAML plugin is not obscure; it’s a tool relied upon by numerous organizations for secure authentication. This incident serves as a stark reminder that even trusted plugins can harbor significant security flaws. As WordPress continues to dominate the CMS landscape, the security of its plugins must be scrutinized more rigorously. Users should not only keep their plugins updated but also regularly audit their security configurations.
- Two critical vulnerabilities in miniOrange SAML plugin
- Unauthenticated access to WordPress admin accounts
- Active exploitation of these flaws reported
First reported by The Hacker News.