> TritonInfoSec News
Home / Aug 26, 2026 / Story
0
#3 The Hacker News general August 25, 2026 at 08:34 UTC

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

By [email protected] (The Hacker News)

AI Summary

Attackers are actively exploiting two unauthenticated authentication bypass vulnerabilities — CVE-2026-61979 (CVSS 8.1) and CVE-2026-15981 — in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin, allowing privilege escalation to administrator-level access. Any WordPress site using this plugin is at immediate risk of full compromise and should apply Patchstack-disclosed patches without delay.

Read full article → https://thehackernews.com/2026/08/attackers-target…

Relevance score: 84.0/100

# More from August 26

  1. 1
    Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data The Hacker News
  2. 2
    Hackers breached over 270 Zimbra servers in ongoing attacks BleepingComputer
  3. 4
    Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows The Hacker News
  4. 5
    A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw The Hacker News
  5. 6
    Police arrests dozens of suspects in global cybercrime crackdown BleepingComputer
  6. 7
    US sanctions Iranian cyber actors as UK discloses power plant attack The Record
  7. 8
    AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes BleepingComputer
  8. 9
    ToxicPanda Banking Trojan Matures into Enterprise Threat Dark Reading
  9. 10
    TikTok reaches $400M settlement with US over COPPA violations BleepingComputer