Critical Authentication Bypass Vulnerabilities in Xecurify miniOrange SAML WordPress Plugin
Two critical authentication bypass vulnerabilities, CVE-2026-61979 and CVE-2026-15981 (CVSS 9.8), were identified in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin. Attackers exploit flaws in SAML response processing and assertion data manipulation to circumvent Single Sign-On (SSO) logic, allowing unauthenticated actors to assume administrative identities and gain full control of affected WordPress installations. A significant intelligence gap occurred because the plugin's seven product editions share a single identifier (slug), causing premium versions to be omitted from early vulnerability databases while active exploitation was already occurring in the wild. Immediate manual patching and version auditing are required to mitigate risk.