{"id":243135,"date":"2026-08-25T01:21:36","date_gmt":"2026-08-25T06:21:36","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/08\/hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks"},"modified":"2026-08-25T01:21:36","modified_gmt":"2026-08-25T06:21:36","slug":"hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/08\/hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks","title":{"rendered":"Hackers target WordPress sites in miniOrange auth bypass attacks"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks2.jpg\"><\/a><\/p>\n<p>Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators.<\/p>\n<p>The miniOrange SAML SSO plugin turns a WordPress site into a SAML service provider, letting users log in through corporate identity platforms such as Microsoft Entra ID, Okta, Google Workspace, or OneLogin instead of separate WordPress credentials.<\/p>\n<p>Created by Xecurify, miniOrange is a family of seven plugins, with a free version that has <a href=\"https:\/\/wordpress.org\/plugins\/miniorange-2-factor-authentication\/\" rel=\"nofollow noopener\" target=\"_blank\">10,000 downloads<\/a> and <a href=\"https:\/\/www.miniorange.com\/\" rel=\"nofollow noopener\" target=\"_blank\">30,000 customers<\/a> for the other six.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators. The miniOrange SAML SSO plugin turns a WordPress site into a SAML service provider, letting users log in through corporate identity [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-243135","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/243135","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=243135"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/243135\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=243135"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=243135"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=243135"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}