plugin-security

Rank Math Supply Chain Attack Hits WordPress

By Editorial Team | October 23, 2026

Rank Math supply chain attack CVE-2026-111862: backdoored PRO plugin update 3.0.123, October 2026

A Rank Math supply chain attack put malware into the premium plugin’s update channel: version 3.0.123 of Rank Math PRO, downloaded or updated between October 15 (20:02 UTC) and October 16 (07:12 UTC), contained a backdoor. The window lasted about 11 hours. The vendor’s clean build is 3.0.124, and the free plugin from WordPress.org is…

miniOrange SAML SSO Bypass Vulnerability

By Editorial Team | August 28, 2026

A miniOrange SAML SSO bypass (CVE-2026-61979, CVE-2026-15981) lets attackers forge admin logins on WordPress — and most scanners miss it.

A miniOrange SAML SSO bypass is under active exploitation against WordPress sites, and most vulnerability scanners cannot detect whether a given site is actually affected. Two chained authentication bugs, CVE-2026-61979 and CVE-2026-15981 (CVSS 9.8 each), let an unauthenticated attacker forge a SAML login and access wp-admin as any existing user, including administrators. DigitalOcean confirmed exploitation…