Two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 plugin let attackers sign in as any WordPress user, including administrators. Patchstack disclosed the vulnerabilities, assigning CVE‑2026‑61979 a CVSS score of 8.1.

  • Two critical bugs found in miniOrange SAML 2.0 plugin
  • Unauthenticated attackers can log in as any WordPress user
  • Patchstack issued CVE‑2026‑61979 with an 8.1 severity rating

Vulnerability Details

The miniOrange SAML 2.0 Single Sign‑On (SSO) plugin by Xecurify streamlines identity federation for WordPress sites. Patchstack recently uncovered two unauthenticated authentication bypasses, one of which is catalogued as CVE‑2026‑61979 (CVSS 8.1). Exploiting these flaws, an attacker can sign in as any user—admin included—without providing credentials.

Technical Breakdown

The first flaw stems from improper validation of SAML assertions; the plugin accepts a crafted attribute and assigns elevated privileges without verification. The second bypass abuses the plugin’s integration with the WordPress REST API, allowing direct calls to /wp-json/ endpoints to forge a logged‑in session. Both vulnerabilities are fully unauthenticated, meaning no prior user account is required.

Read Also:Erode Handloom Weavers Demand Wage Revision and Welfare Measures

Historical Background

SAML‑based SSO plugins have a track record of security mishaps. Similar critical bugs were disclosed in Auth0 (2018) and Okta (2021), leading to large‑scale data breaches. Those incidents prompted the security community to demand stricter assertion validation and tighter token handling.

Impact and Risks

Sites running an outdated version of the plugin are exposed to full‑scale takeover. With admin rights, attackers can alter site content, exfiltrate user data, inject malware, or launch ransomware campaigns. Compromised WordPress sites also act as stepping stones for broader web‑based attacks.

Mitigation Recommendations

All administrators should immediately upgrade the miniOrange SAML 2.0 plugin to version 2.9.3 or later and apply the Patchstack security patch. Enabling two‑factor authentication and conducting regular plugin audits further reduce risk.

Why This Matters

BozokMedia analysis shows that compromised WordPress sites often serve as launchpads for broader web‑based attacks, amplifying the reach of threat actors across millions of users worldwide.

“SAML‑based SSO plugins must enforce strict assertion validation; otherwise, they become an open door for credential‑free takeovers.” – Dr. Ananya Rao, Cybersecurity Researcher
Did You Know?: In 2020, more than 5,000 successful hacks were traced back to vulnerable WordPress plugins within just a year.

Frequently Asked Questions

Q1: Can I secure my site without updating the plugin?
A1: No. The only reliable fix is to apply the vendor’s patch or upgrade to the latest version.

Q2: Is this issue limited to miniOrange only?
A2: No, other SAML‑based SSO plugins may harbor similar weaknesses, so a comprehensive security audit is advisable.