Back Securityaffairs.Co

Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable

Securityaffairs.Co •Pierluigi Paganini • August 25, 2026

Two CVSS 9.8 miniOrange SAML WordPress plugin auth bypasses were exploited while paid editions never appeared in any vulnerability database. Manual patch required. Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On WordPress plugin, both rated CVSS 9.8, are under active exploitation. Both CVE-2026-61979 and CVE-2026-15981 allow an unauthenticated attacker to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical miniOrange SAML SSO Vulnerabilities Allow WordPress Admin Takeover Two critical authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) have been identified in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress, allowing unauthenticated attackers to forge SAML assertions and log in as any existing user, including administrators. These vulnerabilities, with a CVSS score of 9.8, were disclosed in July 2026 and have been exploited in the wild, with reports of attacks targeting both free and paid versions of the plugin. The vendor's advisory only covered the free edition, leaving many users of the paid editions unaware of their exposure. DigitalOcean reported blocking anomalous admin sessions linked to these vulnerabilities on August 16, 2026. A proof-of-concept exploit for the free edition was made public shortly after the vulnerabilities were disclosed, increasing the risk of exploitation. Website owners must manually upgrade to patched versions as no update warnings are shown for paid editions. 8 sources 72

Extracted Entities

Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable

The full story

Extracted Entities

Companies (1)

CVEs (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)