miniOrange SAML 2.0 Single Sign-On

Active Exploitation of Two Authentication-Bypassing Vulnerabilities in the miniOrange Plugin for WordPress Sites

Researchers are monitoring attempts to exploit two critical vulnerabilities in the miniOrange SAML 2.0 Single Sign-On plugin that could enable the forgery of SAML responses and login with WordPress administrator accounts. The fixes cover all free and paid versions, but the paid versions do not display update notifications in the administration dashboard.