CVE-2026-62126 · Package
NO FIX YET · SEE WHAT TO DO
The miniOrange SAML SP Single Sign On WordPress plugin allocates resources without limits or throttling, so crafted HTTP requests can exhaust the server. An attacker can make the site slow or unavailable over HTTP.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the miniOrange SAML SP Single Sign On plugin for WordPress up to version 6.1.0 are affected. The sources do not say which configurations or endpoints are reachable, so the exact exposure is unknown.
Not affected if plugin-not-installed
Who cares saml, sso, wordpress
miniorange-saml-20-single-sign-on plugin is installed and its version in the WordPress admin Plugins page6.1.0 are affected; move to a later release (the exact fixed version is unknown from the sources)Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-62126") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.