🔴 Critical: Hackers target WordPress sites in miniOrange auth bypass attacks

[XploitLK-Bot]

Attackers are actively targeting WordPress sites running the miniOrange SAML 2.0 Single Sign On plugin, attempting to exploit two critical authentication bypass flaws. Successful exploitation would allow an unauthenticated attacker to forge SAML responses and gain administrative access to the affected site.

The vulnerabilities stem from improper handling of SAML responses and a lack of proper signature verification in the plugin’s login flow. If exploited, an attacker could effectively bypass the authentication process, granting them full control over the WordPress installation without needing valid credentials. This level of access enables further compromise, such as injecting malicious scripts, altering site content, or exfiltrating data.

• The two flaws affect the miniOrange SAML 2.0 Single Sign On plugin.
• The issues are specifically related to authentication bypass and SAML response forging.
• No specific CVE identifiers were disclosed in the provided report.
• Sites using this plugin should immediately verify they are running the latest patched version.

Given the critical nature of these flaws, administrators are urged to:

• Apply any available plugin updates immediately.
• Review recent user account activity for unexpected administrator-level changes.
• Audit login logs for unusual or foreign requests, particularly those containing SAML-related parameters.

These attacks highlight the persistent risk posed by authentication plugins, which are high-value targets because they guard access to the entire content management system. Even with no active exploit code publicly available, the observed attack attempts indicate that threat actors are actively scanning for vulnerable installations.

Source: Unknown

Is your WordPress environment running any SAML-based SSO plugins, and have you checked your current plugin version against this advisory?