Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Attackers are actively targeting the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress, leveraging two critical flaws to assume administrative control of vulnerable sites. The campaign exploits CVE-2026-61979 and CVE-2026-15981, which stem from a flawed signature validation process that incorrectly treats malformed inputs as successful verifications, enabling unauthorized session creation. Since a proof-of-concept exists for these authentication bypasses, site administrators should immediately update to version 17.0.6 of the Standard edition to mitigate this high-risk threat.