[webapps] miniOrange 5.4.3 - Unauthenticated Auth Bypass
A proof-of-concept exploit for an unauthenticated authentication bypass in miniOrange 5.4.3 has been published on Exploit-DB.
Stories per day · 30 days
4 stories, newest first · one card per story
Stories tagged #miniorange
Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable
Attackers actively exploit two CVSS 9.8 auth bypasses (CVE-2026-61979, CVE-2026-15981) in the miniOrange SAML WordPress plugin, forging SAML responses to become admin.
4
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Attackers are exploiting two unauthenticated WordPress auth bypasses (CVE-2026-61979, CVE-2026-15981, max CVSS 9.8) in miniOrange SAML SSO to gain admin sessions.
1
One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin
DigitalOcean researchers reported a critical authentication flaw in miniOrange SAML SSO WordPress plugins, allowing login as WordPress admin across seven editions.