miniOrange SAML Flaws Let Attackers Access WordPress Admins

Attackers are now targeting two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that allow them to sign into any WordPress user account, including administrators. The vulnerabilities were disclosed by Patchstack and carry the identifier CVE‑2026‑61979 with a CVSS score of 8.1 ¹.

The flaws stem from how the plugin implements the WS‑Federation protocol, which is prone to replay attacks if headers or cookies aren’t validated correctly. By manipulating these elements, an attacker can forge authentication tokens and gain full administrative privileges without needing valid credentials. Similar weaknesses appeared in Shibboleth around 2015, where credential theft at universities highlighted the risks of poorly audited third‑party extensions.

Because many small businesses use miniOrange for single sign‑on on shared hosting platforms, updates may be delayed or ignored due to understaffing or convenience factors. Once compromised, attackers can control site content and potentially exfiltrate sensitive personal and financial data using stolen session cookies alone. This makes the vulnerability far more critical than its automated scan score suggests.

Site owners should immediately verify whether they’re running the vulnerable version of the plugin and apply the latest patch released by Xecurify. Monitoring login logs for unusual activity patterns—such as repeated failed attempts followed by successful admin logins—can help detect exploitation early. Additionally, disabling unused SAML services and enforcing strict cookie validation will reduce the attack surface until a comprehensive update is applied.