Threat actors have been attempting to hack WordPress websites by exploiting two recently patched vulnerabilities affecting a MiniOrange plugin.
The two vulnerabilities are CVE-2026-61979 and CVE-2026-15981, and they affect the MiniOrange SAML 2.0 Single Sign-On (SSO) plugin, which enables SSO for WordPress websites.
The free edition of the plugin is installed on more than 10,000 WordPress sites, but there are also several paid and enterprise versions for which usage statistics are not available.
According to an analysis conducted by DigitalOcean and security firm Patchstack, the vulnerabilities are critical authentication bypasses that can be exploited to log in as any WordPress user, including administrators.
Threat actors have been attempting to exploit CVE-2026-61979 and CVE-2026-15981 in what Patchstack described as opportunistic attacks rather than a targeted campaign.
The problem is that while all affected versions of the MiniOrange SAML 2.0 SSO plugin have been patched, the developer has not warned users about the potential risks. Only the free edition has an advisory that mentions the fix in version 5.4.5, but it’s listed as a bugfix rather than a security patch.
In the case of the paid editions, users have not been notified and a different versioning system makes it difficult to tell whether a website is patched; users have to manually update the plugin.
“Whoever is running this appears to be throwing the exploit at every site with the plugin installed without checking which edition or version is behind it,” Patchstack warned. “This is exactly the behavior that makes the silent-patch situation dangerous. The attacker does not need to know which edition you run, you do.”
SecurityWeek has reached out to the developer for comment and will update this article if it responds.
Related: 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw
Related: WordPress 7.0.4 Patches Remote Code Execution Vulnerability
Related: WP2Shell WordPress Vulnerabilities Exploited in the Wild
