Vulnerabilities / Login using WordPress Users ( WP as SAML IDP ) / WPSEC-2026-0873
Login using WordPress Users ( WP as SAML IDP ) <= 2.0.1 - Unauthenticated Denial of Service via SAMLRequest Decompression
Medium 5.3
CWE-409Fixed in 2.0.2
- ID
- WPSEC-2026-0873
- Plugin
- SAML IDP (Identity Provider) – Login with Website Users (miniorange-wp-as-saml-idp)
- Affected
- all versions before 2.0.2
- Remediation
- Update to 2.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-409
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-14
- Attack surface
- Login using WordPress Users ( WP as SAML IDP ) on WPSec AttackSurface
- Fix released
- Published
Description
The SAML IDP (Identity Provider) plugin for WordPress is vulnerable to Denial of Service via the SAMLRequest parameter in all versions up to, and including, 2.0.1. The plugin places no limit on the size of the Base64-encoded request or of the data produced when it is inflated with gzinflate(). This makes it possible for unauthenticated attackers to send small compressed payloads that inflate to very large sizes (a decompression bomb). Each such request uses memory up to the PHP memory limit and wastes CPU time, which can degrade the site's availability.
References
- https://wpsec.com/vuln/WPSEC-2026-0873/
- https://plugins.svn.wordpress.org/miniorange-wp-as-saml-idp/tags/2.0.2/
- https://wordpress.org/plugins/miniorange-wp-as-saml-idp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS