HACKERS TARGET WORDPRESS SITES IN MINIORANGE AUTH BYPASS ATTACKS

Summary from the TLDR InfoSec newsletter

Attackers are actively chaining two critical vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the miniOrange SAML 2.0 SSO plugin to bypass authentication and gain administrator access to WordPress sites. Malicious actors can successfully forge legitimate SAML responses by manipulating cryptographic algorithms and bypassing OpenSSL signature checks. Administrators must manually verify their plugin version and immediately upgrade to the latest patched release, as the native WordPress dashboard will not surface update warnings for premium editions.