Critical 9.8
CVE-2026-61979
miniOrange SAML SSO Plugin Vulnerabilities Exploited in the Wild
Vendor / product: miniOrange SAML 2.0 Single Sign On plugin for WordPress
Event date: 2026-08-16
Victim organization: DigitalOcean
Public PoC: Yes
First tracked by RiskWire: 2026-08-21
Sources & citations (3)
- One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin patchstack.com · 2026-08-21
- Hackers target WordPress sites in miniOrange auth bypass attacks bleepingcomputer.com · 2026-08-24
- Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access thehackernews.com · 2026-08-25
References
See CVE-2026-61979 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →