WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
Two critical authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the MiniOrange SAML 2.0 SSO WordPress plugin allow attackers to log in as any user, including administrators Threat actors are actively exploiting these vulnerabilities in opportunistic, untargeted attacks across the wild The plugin's free edition is installed on over 10,000 WordPress sites, with additional paid and enterprise versions affected The developer has patched all affected versions but failed to a
Analysis
TL;DR
- Two critical authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the MiniOrange SAML 2.0 SSO WordPress plugin allow attackers to log in as any user, including administrators
- Threat actors are actively exploiting these vulnerabilities in opportunistic, untargeted attacks across the wild
- The plugin's free edition is installed on over 10,000 WordPress sites, with additional paid and enterprise versions affected
- The developer has patched all affected versions but failed to adequately notify users, listing the fix as a routine bugfix rather than a security patch
- Paid edition users face additional risk due to a different versioning system that makes it difficult to confirm whether a site is patched
Why It Matters
This incident highlights a critical gap in the WordPress plugin security ecosystem where developers can silently patch vulnerabilities without proper disclosure, leaving site operators unaware of active exploitation. For AI practitioners and security professionals, it underscores the importance of proactive vulnerability monitoring and the risks of relying on plugin developers for security communication rather than independent security advisories.
Technical Details
- CVE-2026-61979 and CVE-2026-15981: Both are critical authentication bypass flaws in the MiniOrange SAML 2.0 Single Sign-On plugin that enable unauthorized access as any WordPress user, including admin-level accounts
- Affected installations: The free edition alone is deployed on more than 10,000 WordPress sites; paid and enterprise editions add an unknown additional attack surface
- Patch status: All affected versions have been patched, with the free edition update available in version 5.4.5, though the developer categorized it as a bugfix rather than a security-critical patch
- Attack pattern: Analysis by DigitalOcean and Patchstack confirms opportunistic, automated exploitation rather than a coordinated targeted campaign
- Versioning complexity: Paid editions use a separate versioning system, making it difficult for administrators to determine whether their installation has been patched without manual verification
Industry Insight
- WordPress site operators should immediately audit their plugin inventory and manually verify patch status across all editions, as passive reliance on developer notifications proved insufficient in this case
- The "silent patch" phenomenon demonstrates a systemic risk in open-source ecosystems where security fixes without proper disclosure can leave organizations vulnerable during the window between patching and awareness
- Security monitoring tools and vulnerability scanners should be configured to detect exploitation attempts of these specific CVEs, as active in-the-wild attacks indicate ongoing risk even after patches are available
Disclaimer: The above content is generated by AI and is for reference only.