---
id: "CVE-2026-62126"
kind: "vulnerability"
aliases: ["CVE-2026-62126"]
title: "WordPress SAML SP plugin: unthrottled requests allow denial of service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "saml", "sso", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-04T08:17:17+00:00"
first_seen_at: "2026-11-04T08:26:00+00:00"
updated_at: "2026-11-04T08:26:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62126", "first_seen_at": "2026-11-04T08:26:00+00:00"}]
---

# WordPress SAML SP plugin: unthrottled requests allow denial of service

The miniOrange SAML SP Single Sign On WordPress plugin allocates resources without limits or throttling, so crafted HTTP requests can exhaust the server. An attacker can make the site slow or unavailable over HTTP.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `miniorange-saml-20-single-sign-on` plugin is installed and its version in the WordPress admin Plugins page

## Fix

- Versions up to and including `6.1.0` are affected; move to a later release (the exact fixed version is unknown from the sources)

## Timeline

- 2026-11-04T08:26:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62126

## From the sources

Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_