Critical miniOrange SAML SSO Flaws Let Attackers Take Over WordPress Admin Accounts

Gbhackers •Divya • August 25, 2026

Two critical vulnerabilities have been identified in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, which could allow unauthenticated attackers to forge SAML assertions and log in as any existing user, including site administrators. These vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, carry a CVSS score of 9.8. Research conducted by DigitalOcean’s security team and later […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical miniOrange SAML SSO Vulnerabilities Allow WordPress Admin Takeover Two critical authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) have been identified in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress, allowing unauthenticated attackers to forge SAML assertions and log in as any existing user, including administrators. These vulnerabilities, with a CVSS score of 9.8, were disclosed in July 2026 and have been exploited in the wild, with reports of attacks targeting both free and paid versions of the plugin. The vendor's advisory only covered the free edition, leaving many users of the paid editions unaware of their exposure. DigitalOcean reported blocking anomalous admin sessions linked to these vulnerabilities on August 16, 2026. A proof-of-concept exploit for the free edition was made public shortly after the vulnerabilities were disclosed, increasing the risk of exploitation. Website owners must manually upgrade to patched versions as no update warnings are shown for paid editions. 6 sources 72

Extracted Entities

Critical miniOrange SAML SSO Flaws Let Attackers Take Over WordPress Admin Accounts

The full story

Extracted Entities

CVEs (2)

CWE Weaknesses (1)

Platforms (1)