miniOrange SAML SSO Vulnerabilities: WordPress Admin Bypass

A critical security risk has emerged for WordPress platforms following the discovery of two authentication bypass vulnerabilities within the miniOrange SAML SSO plugin. These flaws enable malicious actors to trick the plugin into accepting forged SAML responses, ultimately allowing the attacker to sign in as an existing WordPress administrator without needing a password or compromising the Identity Provider (IdP).

Real-world exploitation has successfully harvested administrator session cookies. Website operators should closely analyze logs and traffic patterns by observing specific indicators:

• Correlating WordPress SAML successes that occurred without IdP authentication
• Noticing admin cookie usage immediately following incoming SAML POST requests
• Tracking /wp-admin access originating from outside trusted network perimeters
• Distinguishing between mere cookie acquisition and subsequent administrative actions or code execution

Stock photo for illustration only, not from the actual event

To secure affected environments, administrators should immediately implement robust containment measures:

• Verify exact miniOrange editions and versions instead of relying solely on slugs, and manually update to patched releases
• Restrict /wp-admin access strictly to VPNs or pre-approved IP address ranges
• Invalidate all active sessions and thoroughly audit system files and administrator accounts

Because these attacks succeed seamlessly without requiring user interaction, clicks, or multi-factor authentication (MFA) approvals, end-user prevention remains extremely difficult. Administrators must immediately report and investigate unexpected login notifications, site configuration adjustments, post modifications, or user updates.

Source: Dev.to