CVE-2026-61979KEVEXPLOITED

miniorange · saml sp single sign on

WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

Description

Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

Affected Products

Vendor	Product	Versions
miniorange	saml sp single sign on	n/a

References

https://patchstack.com/database/wordpress/plugin/miniorange-saml-20-single-sign-on/vulnerability/wordpress-saml-sp-single-sign-on-plugin-5-4-3-privilege-escalation-vulnerability?_s_id=cve(vdb-entry)

Related News (4 articles)

Tier D

SecurityWeek3h ago

WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities

→ No new info (linked only)

Tier D

The Hacker News8h ago

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

→ No new info (linked only)

Tier D

BleepingComputer21h ago

Hackers target WordPress sites in miniOrange auth bypass attacks

→ No new info (linked only)

Tier C

VulDB12d ago

CVE-2026-61979 | miniOrange SAML SP Single Sign On Plugin up to 5.4.3 on WordPress privileges management

→ No new info (linked only)

CVSS 3.18.1 HIGH

VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV✅ Yes

Actively exploited✅ Yes

CWECWE-266

PublishedAug 13, 2026

Trending Score119🔥

Source articles4

Independent4

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-28148

WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

Trending: 11

CRITICALCVE-2026-61967

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Trending: 11

CRITICALCVE-2026-28149

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Trending: 11

CRITICALCVE-2026-28008

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

Trending: 11

HIGHCVE-2026-73351

WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability

Trending: 10

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Aug 13, 2026

Added to CISA KEV

Aug 13, 2026

Discovered by ZDM

Aug 13, 2026

Actively Exploited

Aug 13, 2026