Hackers exploit critical auth bypass flaws in WordPress miniOrange plugin
Two SAML vulnerabilities in the miniOrange SSO plugin allow attackers to forge login credentials and gain admin access to WordPress sites.
What to know
- Two critical authentication bypass flaws in the miniOrange SAML 2.0 plugin for WordPress are under active exploitation.
- Attackers can forge SAML responses to gain unauthorized administrative access to affected WordPress sites.
- The vulnerability affects WordPress installations using miniOrange for enterprise single sign-on integration.
miniOrange SAML SSO plugin developerHackers Attackers
The record 7 articles and posts · last 30 days
- summary covers to here · Aug 25, 7:11 AM · 3 pieces above arrived after
What people are saying 3 voices from 1 site · verbatim
- Aug 25
-
S
Why are we still talking about miniorange? Just because it was handled so poorly? https:// securityaffairs.com/197815/sec urity/two-cvss-9-8-auth-bypasses-in-miniorange-saml-wordpress-plugin-were-exploited-before-any-database-even-listed-the-paid-editions-as-vulnerable.html # breach # wordpress
-
O
「ハッカーがminiOrange認証バイパス攻撃でWordPressサイトを標的に」： # BLEEPINGCOMPUTER 「ハッカーたちは、WordPress 用の miniOrange SAML 2.0 シングルサインオンプラグインに存在する、認証をバイパスする2つの重大な脆弱性を悪用しようとしています。これらの脆弱性を悪用すると、SAML レスポンスを偽造し、管理者としてログインすることが可能になります。 miniOrange SAML SSOプラグインを使用すると、WordPressサイトをSAMLサービスプロバイダーに変換し、ユーザーはWordPressの認証情報ではなく、Microsoft Entra ID、Okta、Google…
- Aug 24
-
B
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators. https://www. bleepingcomputer.com/news/secu rity/hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks/