GoKawiilAttackers actively exploit auth-bypass flaws in miniOrange SSO plugin for WordPress
Security researchers say hackers are exploiting two chained vulnerabilities, CVE-2026-61979 and CVE-2026-15981, in the miniOrange SAML 2.0 Single Sign On plugin to forge SAML responses and log into WordPress sites as administrators. The plugin, made by Xecurify, lets sites authenticate through identity providers like Microsoft Entra ID, Okta, Google Workspace or OneLogin, and comes in a free version plus six paid editions used by roughly 30,000 customers.
GoKawiil's interpretation of the reporting above, not reported fact.
Both flaws were patched in July, but Xecurify's advisory only mentioned the free edition, leaving many paying customers unaware their sites were still vulnerable to full admin takeover. Since SSO plugins sit at the core of site authentication, exploitation gives attackers complete control over affected WordPress installations, making prompt patching across every paid tier urgent.
- Two chained CVEs let attackers forge SAML signatures and log in as WordPress admins.
- Fixes exist for all seven plugin editions, but only the free version's advisory was public.
- Site owners on paid miniOrange SSO tiers should update immediately to the patched versions.
YubiKey 5 NFC Security Key — When authentication plugins fail, a hardware security key keeps your admin logins locked down with phishing-resistant two-factor auth. The YubiKey 5 NFC works with WordPress 2FA plugins, Google Workspace, Okta and Microsoft accounts, and just taps to authenticate over USB-A or NFC. It's a simple physical layer of defense for anyone managing sites and identity platforms.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-24
Published there as: “Hackers target WordPress sites in miniOrange auth bypass attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.