Hackers exploit miniOrange SAML bypass to seize WordPress admin access
Two critical vulnerabilities allow attackers to forge authentication responses and gain full administrative control over affected websites.
Security researchers have identified two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. These flaws allow unauthenticated attackers to forge security responses and gain unauthorized administrative access to affected websites.
According to reports from BleepingComputer and security firms Patchstack and Wordfence, the vulnerabilities—tracked as CVE-2026-61979 and CVE-2026-15981—enable attackers to bypass standard login protocols. By forging SAML responses, a malicious actor can impersonate any WordPress user, including those with full administrative privileges, without needing valid credentials.
The Role of SAML in WordPress
SAML, or Security Assertion Markup Language, is an industry-standard framework used to exchange authentication and authorization data between an identity provider and a service provider. In this ecosystem, the miniOrange plugin serves as the service provider, allowing WordPress sites to delegate authentication to a centralized identity system. When this process is compromised, the trust relationship between the identity provider and the website is broken, allowing forged assertions to be accepted as legitimate logins.
Risks of Administrative Compromise
Unauthorized administrative access represents the highest possible risk level for a WordPress installation. Once an attacker gains admin rights, they possess the ability to steal sensitive user data, modify or delete website content, and alter core system configurations. Furthermore, administrative access is frequently used to install backdoors or distribute malware to the site's visitors, potentially turning a trusted business website into a vector for wider cyberattacks.
Current Threat Landscape
Security analysts report that hackers are actively targeting WordPress sites using these specific authentication bypass attacks. Because the vulnerabilities allow for the impersonation of high-level accounts, the impact is immediate and severe. Site owners are urged to verify their plugin versions and apply security patches immediately to close the gap. While the vulnerabilities are confirmed, the full scale of the exploitation across the WordPress ecosystem remains under observation by security researchers.