{"id":"CVE-2026-62126","kind":"vulnerability","aliases":["CVE-2026-62126"],"related":[],"title":"WordPress SAML SP plugin: unthrottled requests allow denial of service","description":"Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0.","summary":"The miniOrange SAML SP Single Sign On WordPress plugin allocates resources without limits or throttling, so crafted HTTP requests can exhaust the server. An attacker can make the site slow or unavailable over HTTP.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","saml","sso","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `miniorange-saml-20-single-sign-on` plugin is installed and its version in the WordPress admin Plugins page","fix":"- Versions up to and including `6.1.0` are affected; move to a later release (the exact fixed version is unknown from the sources)","status":"open","published_at":"2026-11-04T08:17:17+00:00","first_seen_at":"2026-11-04T08:26:00+00:00","triaged_at":"2026-11-04T08:26:28+00:00","updated_at":"2026-11-04T08:26:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T08:26:28Z","model":"claude-haiku-5-5","output":{"fix":"- Versions up to and including `6.1.0` are affected; move to a later release (the exact fixed version is unknown from the sources)","reach":"internet","title":"WordPress SAML SP plugin: unthrottled requests allow denial of service","impact":"low","summary":"The miniOrange SAML SP Single Sign On WordPress plugin allocates resources without limits or throttling, so crafted HTTP requests can exhaust the server. An attacker can make the site slow or unavailable over HTTP.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","saml","sso"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote HTTP requests exhaust server resources and cause denial of service","analyst_note":"Confirm the fixed version and which endpoint is affected at https://nvd.nist.gov/vuln/detail/CVE-2026-62126 and the plugin's changelog.","how_to_check":"- Check whether the `miniorange-saml-20-single-sign-on` plugin is installed and its version in the WordPress admin Plugins page\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the miniOrange SAML SP Single Sign On plugin for WordPress up to version 6.1.0 are affected. The sources do not say which configurations or endpoints are reachable, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4123,"output_tokens":558,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62126':13A,16A '20':73C '6.1.0':91C 'affect':82C 'alloc':30B,55C 'allow':7A,78C 'attack':45B 'craft':37B 'cve':11A,14A 'denial':8A 'dos.this':80C 'exhaust':41B 'http':38B,54B,79C 'issu':81C 'limit':33B,59C 'make':47B 'miniorang':22B,64C,71C 'miniorange-saml':70C 'n/a':89C 'packag':17B 'plugin':4A,29B 'request':6A,39B 'resourc':31B,57C 'saml':2A,18B,23B,65C,72C,83C 'server':43B 'servic':10A 'sign':26B,68C,76C,86C 'singl':25B,67C,75C,85C 'single-sign-on':74C 'site':49B 'slow':50B 'sp':3A,24B,66C,84C 'sso':19B 'throttl':35B,61C 'unavail':52B 'unthrottl':5A 'vulner':62C 'without':32B,58C 'wordpress':1A,20B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the miniOrange SAML SP Single Sign On plugin for WordPress up to version 6.1.0 are affected. The sources do not say which configurations or endpoints are reachable, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","saml","sso","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62126","severity":null,"published_at":"2026-11-04T08:17:17+00:00","modified_at":"2026-11-04T08:17:18+00:00","first_seen_at":"2026-11-04T08:26:00+00:00","fetched_at":"2026-11-04T08:26:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}