WORDPRESS PLUGIN UNDER ATTACK FOR AUTH BYPASS FLAWS

The miniOrange SAML 2.0 plugin, used for single sign-on authentication on WordPress sites, contains two critical vulnerabilities that enable authentication bypass attacks. Attackers can leverage these flaws to forge SAML responses, granting them unauthorized administrator-level access to compromised WordPress installations. This represents a severe security risk for organizations relying on the plugin for authentication. The vulnerabilities affect the plugin's validation mechanisms, allowing threat actors to circumvent security checks designed to verify legitimate login credentials. WordPress administrators using miniOrange SAML 2.0 should update to the latest patched version immediately. Organizations should also review recent access logs for suspicious administrative account activity. This attack represents a broader pattern of threat actors targeting WordPress authentication plugins, which serve as centralized security points for many installations.