Reports indicate that WordPress websites are currently being targeted through the exploitation of two authentication bypass vulnerabilities found in the MiniOrange SAML 2.0 SSO plugin. These vulnerabilities have been assigned the identifiers CVE-2026-61979 and CVE-2026-15981. The active targeting suggests that attackers are leveraging these flaws to gain unauthorized access to affected WordPress installations.
The vulnerabilities, CVE-2026-61979 and CVE-2026-15981, are described as authentication bypass issues. This class of vulnerability typically allows an attacker to circumvent the normal login process, potentially gaining access to administrative functions or privileged user accounts without providing valid credentials. In the context of a SAML Single Sign-On (SSO) plugin, such flaws could arise from improper validation of SAML assertions, insecure handling of session tokens, or logical errors in the authentication flow that allow an attacker to craft requests that are mistakenly interpreted as legitimate by the plugin.
The affected product is the MiniOrange SAML 2.0 SSO plugin, which is designed to integrate SAML-based single sign-on capabilities into WordPress websites. This plugin is commonly used by organizations to allow users to authenticate once with an identity provider (IdP) and then access multiple service providers (SPs), including their WordPress site, without re-entering credentials. The presence of authentication bypasses in such a critical security component is significant.
The scope of potential impact extends to any WordPress website utilizing the vulnerable versions of the MiniOrange SAML 2.0 SSO plugin. Given the widespread adoption of WordPress as a content management system and the common use of SSO solutions in enterprise and educational environments, a substantial number of sites could be at risk. Successful exploitation could lead to unauthorized access, data breaches, website defacement, or further compromise of the underlying server infrastructure.
Typical mitigation guidance for this class of issue involves several steps. Website administrators should immediately identify if they are using the MiniOrange SAML 2.0 SSO plugin and, if so, determine the installed version. The primary recommendation is to update the plugin to the latest patched version as soon as one becomes available from the vendor. If an immediate update is not feasible, temporary measures might include disabling the plugin if its functionality is not critical, or implementing web application firewall (WAF) rules designed to detect and block exploitation attempts, though WAFs may not always fully protect against logic flaws.
Administrators should also review their website access logs for any suspicious activity that might indicate a successful compromise, such as unusual login attempts, changes to user accounts, or unexpected file modifications. Regular backups are also crucial to facilitate recovery in the event of a successful attack.
This incident underscores the ongoing security challenges associated with third-party plugins and extensions in popular content management systems. Even well-regarded plugins can harbor critical vulnerabilities, and the rapid pace of exploitation highlights the importance of timely patching and proactive security measures for all website operators.
