Xecurify

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenAug 25, 2026
Last mentionedAug 25, 2026

Timeline

1 articles · newest first

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Attackers are exploiting two unauthenticated WordPress auth bypasses (CVE-2026-61979, CVE-2026-15981, max CVSS 9.8) in miniOrange SAML SSO to gain admin sessions.

The Hacker NewsAug 25, 08:34 UTC · Aug 25, 2026Exploit / PoCExploitedCVE-2026-61979 CVE-2026-159811 · 1 read

Related CVEs

by mentions

CVE-2026-15981<1%9.8
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4
published Jul 23, 2026WordPress
CVE-2026-61979<1%8.1
Unauthenticated privilege escalation in miniOrange SAML SSO WordPress plugin
published Aug 13, 2026miniOrange SAML SP Single Sign On (WordPress plugin)

Appears with

miniOrangevendor · 1
Patchstackvendor · 1
DigitalOceanvendor · 1
WordPressproduct · 1
miniOrange SAML 2.0 Single Sign Onproduct · 1

Entities are extracted by the model from each article. First seen Aug 25, 2026, last mentioned Aug 25, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.