The first issue, CVE-2026-61979, carries a CVSS score of 8.1 and is described as an unauthenticated privilege escalation. This flaw stems from improper handling of the SAML response validation process, enabling a malicious actor to forge a valid session without needing valid credentials.

• The second vulnerability has not been disclosed with a specific CVE identifier in the reporting, but it is similarly severe, involving an authentication bypass that can be chained with the first to achieve full account takeover.
• Successful exploitation grants the attacker the exact role and capabilities of the targeted user account, meaning a single compromised request can lead to complete site compromise if an admin account is hijacked.

WordPress administrators using the miniOrange SAML 2.0 Single Sign On plugin should verify they are running the latest patched version immediately. Given that this is an unauthenticated attack vector, there is no indication of prior access required, making it a critical risk for any site with the plugin active.

Source: The Hacker News

Is your team already tracking this plugin's update status, or are you relying on a WAF to mitigate these bypass attempts before a patch is applied?