CVE-2026-61979

CVE-2026-61979 is an unauthenticated privilege-escalation flaw (CWE-266, incorrect assignment of privileges) in the miniOrange 'SAML SP Single Sign On' plugin for WordPress, affecting every version up to and including 5.4.3. Because it is reachable over the network with no privileges required and no user interaction (the CVSS 3.1 vector rates attack complexity as high), a remote attacker can abuse the plugin's SAML single sign-on handling to gain WordPress administrator-level privileges without valid credentials. With administrator access, an attacker can modify content, install plugins or themes, create rogue admin accounts, and use the site as a foothold. Any WordPress site running the affected versions is exposed, and reporting indicates the plugin's paid editions were also vulnerable to related flaws in the same campaign. No public proof-of-concept is known for this specific flaw and it is not in CISA KEV (EPSS ~0.3% over 30 days), but two separate CVSS 9.8 authentication-bypass flaws in the same plugin were exploited in the wild before they were even catalogued, and attackers are actively targeting miniOrange SAML flaws that grant WordPress admin access.

What to do: Update the SAML SP Single Sign On plugin to a version newer than 5.4.3 on every site, including any paid editions, and deactivate the plugin temporarily if immediate patching is not possible. Audit the site for unauthorized administrator accounts, unexpected user role or privilege changes, and recently modified plugins or files, since related flaws in this plugin have been actively exploited. Review web logs for requests to the plugin's SAML endpoints and rotate administrator credentials if unknown accounts had admin access.