As cited
Copy frozen at (site build).
Hackers target WordPress sites in miniOrange auth bypass attacks
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Hackers target WordPress sites in miniOrange auth bypass attacks
Attackers are probing WordPress installations for two critical authentication bypass flaws in the miniOrange Security Assertion Markup Language (SAML) 2.0 SSO plugin that allow forged SAML responses and admin-level login. The vulnerabilities affect the plugin’s handling of SAML assertions and can be triggered remotely without credentials. Security teams should verify plugin versions and apply any available patches or mitigations.
Why it matters: WordPress administrators using the miniOrange SAML 2.0 SSO plugin risk admin account takeover via forged SAML responses and should immediately check plugin versions and apply patches.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Hackers target WordPress sites in miniOrange auth bypass attacks
Attackers are probing WordPress installations for two critical authentication bypass flaws in the miniOrange Security Assertion Markup Language (SAML) 2.0 SSO plugin that allow forged SAML responses and admin-level login. The vulnerabilities affect the plugin’s handling of SAML assertions and can be triggered remotely without credentials. Security teams should verify plugin versions and apply any available patches or mitigations.
Why it matters: WordPress administrators using the miniOrange SAML 2.0 SSO plugin risk admin account takeover via forged SAML responses and should immediately check plugin versions and apply patches.
- Source published
- First seen by Cybersecurity Tracker