Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Attackers are exploiting two severe vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin, which can allow them to bypass authentication and sign in as any WordPress user, including administrators. The vulnerabilities, disclosed by Patchstack, include CVE-2026-61979, an unauthenticated privilege escalation issue with a CVSS score of 8.1. This flaw can grant an attacker administrative access to a WordPress site. The vulnerabilities are being targeted by bad actors, putting WordPress sites that use the affected plugin at risk.