Vulnerabilities & Exploits · Web App Attack

miniOrange SAML Bugs Now See PoC Scanning

Patchstack says attackers are scanning for two Xecurify miniOrange SAML 2.0 Single Sign On WordPress flaws, CVE-2026-61979 and CVE-2026-15981, and a public proof of concept is now available. The bugs can let an unauthenticated attacker sign in as any WordPress user, including an administrator.

The break is in the SAML trust check: a malformed or confused signature can be treated as valid, so WordPress mints a logged-in session cookie for the attacker instead of rejecting the login. Once that happens, the site is already compromised even if the admin panel sits behind a trusted network.

That makes the exposure sit in the login path, not at the panel. For WordPress fleets using this plugin for staff or admin access, the question is whether any unpatched instance can still accept a forged SAML assertion and hand over a standing admin session.

3 sources · Aug 25

CVE-2026-15981

NVD KEV

CVSS 9.8 CRITICAL: the SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. EPSS 2% (79th percentile).

CVE-2026-61979

NVD KEV

CVSS 8.1 HIGH: unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. EPSS 0.4% (28th percentile).

Timeline

Aug 25 Reported by SecurityWeek
Aug 24 Reported by BleepingComputer

Sources

Aug 25 SecurityWeek
WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin.
original
Aug 25 The Hacker News
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Attackers are scanning for two miniOrange SAML flaws, including CVE-2026-15981, that can bypass login and grant WordPress admin access.
original
Aug 24 BleepingComputer
Hackers target WordPress sites in miniOrange auth bypass attacks
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators.
original

Part of the PlainSec briefing for 2026-08-25

Every edition of this story: miniOrange SAML Bugs Now See PoC Scanning

More from today

Vulnerabilities & Exploits · Web App AttackminiOrange SAML Bugs Now See PoC ScanningPatchstack says attackers are scanning for two Xecurify miniOrange SAML 2.0 Single Sign On WordPress flaws, CVE-2026-61979 and CVE-2026-15981, and a public proof of concept is now available. The bugs can let an unauthenticated attacker sign in as any WordPress user, including an administrator.The break is in the SAML trust check: a malformed or confused signature can be treated as valid, so WordPress mints a logged-in session cookie for the attacker instead of rejecting the login. Once that happens, the site is already compromised even if the admin panel sits behind a trusted network.That makes the exposure sit in the login path, not at the panel. For WordPress fleets using this plugin for staff or admin access, the question is whether any unpatched instance can still accept a forged SAML assertion and hand over a standing admin session.3 sources · Aug 25

CVE-2026-15981

NVD KEV

CVSS 9.8 CRITICAL: the SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. EPSS 2% (79th percentile).

CVE-2026-61979

NVD KEV

CVSS 8.1 HIGH: unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. EPSS 0.4% (28th percentile).

Timeline

Aug 25 Reported by SecurityWeek

Aug 24 Reported by BleepingComputer

Sources

Aug 25 SecurityWeek

WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin.

original

Aug 25 The Hacker News

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Attackers are scanning for two miniOrange SAML flaws, including CVE-2026-15981, that can bypass login and grant WordPress admin access.

original

Aug 24 BleepingComputer

Hackers target WordPress sites in miniOrange auth bypass attacks

Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators.

original

Part of the PlainSec briefing for 2026-08-25Every edition of this story: miniOrange SAML Bugs Now See PoC ScanningMore from today

Defender flaw now has a PoC and federal clock

TeamCity Flaw Puts Build Servers in Play

Keycloak Reset Bypass Now Means Account Takeover