Attackers Exploit Unauthenticated Bypasses in miniOrange SAML Plugin to Gain WordPress Admin Access

Recent reporting from Patchstack and coverage by The Hacker News indicate that active exploitation of two severe unauthenticated authentication bypass vulnerabilities is targeting the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress. The vulnerabilities, disclosed in August 2026, allow attackers to bypass authentication entirely and sign in as any WordPress user, including administrators.

CVE-2026-61979 is listed with a CVSS score of 8.1 and pertains to an unauthenticated privilege escalation. CVE-2026-61980, with a CVSS score of 8.6, is also an unauthenticated authentication bypass. Together, these flaws enable an attacker with no prior credentials to gain full administrative control over affected WordPress installations.

The miniOrange SAML 2.0 Single Sign On plugin is widely used to integrate WordPress sites with identity providers via the SAML 2.0 protocol. The authentication bypasses undermine the security of this integration, allowing unauthenticated actors to exploit the trust relationship between the plugin and the WordPress site. Successful exploitation could lead to full site compromise, including content manipulation, data exfiltration, and the deployment of malicious code.

Xecurify has released a patch addressing the vulnerabilities. Security teams are advised to update the miniOrange SAML 2.0 Single Sign On plugin to the latest available version immediately. If immediate updating is not feasible, disabling the plugin is recommended as a temporary mitigation, though this may disrupt SAML-based single sign-on functionality for legitimate users.

WordPress site administrators should verify that their plugin version is up to date and monitor for any unusual authentication events. The widespread deployment of the affected plugin means the vulnerabilities pose a significant risk to a large number of websites globally.