Hackers target WordPress sites in miniOrange auth bypass attacks

By Bill Toulas

AI Summary

Active exploitation attempts are underway against two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, which can be abused to forge SAML responses and authenticate as administrators without credentials. WordPress site administrators running this plugin should apply patches immediately, as SAML auth bypass flaws provide direct privileged access to affected installations.

Read full article → https://www.bleepingcomputer.com/news/security/hac…

Relevance score: 74.0/100

# More from August 25

1
Iran-Linked Hackers Shut Down UK Power Plant for Four Days SecurityWeek
2
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account The Hacker News
3
CISA orders urgent patching of actively exploited Zimbra flaw BleepingComputer
4
Uber Fined Nearly $1 Billion by Dutch Regulators Over Automated Suspensions of Driver Accounts SecurityWeek
5
91 Vulnerabilities Patched in Spring Application Framework SecurityWeek
6
TikTok Reaches $400 Million Settlement With US Justice Department Over Children’s Privacy SecurityWeek
7
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit The Hacker News
8
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor The Hacker News
10
Unpatched Calix flaw lets hackers bypass NAT to expose internal devices BleepingComputer