Filtered by category: Hacker News, tag: authentication bypass × Clear
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Matched: WordPress
Five critical flaws in WordPress plugins and themes — WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP — could allow attackers to bypass authentication, take over accounts, or execute arbitrary code. Reported by Wordfence and Patchstack, the vulnerabilities carry CVSS scores as high as 9.8. Site owners are urged to update affected components immediately.
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Matched: WordPress
Attackers are exploiting two critical authentication bypass flaws in the miniOrange SAML 2.0 Single Sign On WordPress plugin. The vulnerabilities, tracked as CVE-2026-61979 and assigned a CVSS score of 8.1, allow unauthenticated attackers to log in as any WordPress user, including administrators. The flaws were disclosed by Patchstack, and active exploitation attempts have already been observed.