{
 "id": "WPSEC-2026-0873",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0873/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0873/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0873/index.md",
 "title": "Login using WordPress Users ( WP as SAML IDP ) <= 2.0.1 - Unauthenticated Denial of Service via SAMLRequest Decompression",
 "description": "The SAML IDP (Identity Provider) plugin for WordPress is vulnerable to Denial of Service via the SAMLRequest parameter in all versions up to, and including, 2.0.1. The plugin places no limit on the size of the Base64-encoded request or of the data produced when it is inflated with gzinflate(). This makes it possible for unauthenticated attackers to send small compressed payloads that inflate to very large sizes (a decompression bomb). Each such request uses memory up to the PHP memory limit and wastes CPU time, which can degrade the site's availability.",
 "plugin": {
  "slug": "miniorange-wp-as-saml-idp",
  "name": "Login using WordPress Users ( WP as SAML IDP )",
  "full_name": "SAML IDP (Identity Provider) – Login with Website Users",
  "wordpress_org": "https://wordpress.org/plugins/miniorange-wp-as-saml-idp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/miniorange-wp-as-saml-idp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/miniorange-wp-as-saml-idp"
 },
 "type": "DOS",
 "cwe": [
  "CWE-409"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.0.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.0.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.0.2",
 "remediation": "Update to 2.0.2 or later.",
 "fix_released": "2026-10-13T06:55:34+00:00",
 "published": "2026-10-14T07:47:43+00:00",
 "updated": "2026-10-13T12:13:47.085385+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0873/",
  "https://plugins.svn.wordpress.org/miniorange-wp-as-saml-idp/tags/2.0.2/",
  "https://wordpress.org/plugins/miniorange-wp-as-saml-idp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/miniorange-wp-as-saml-idp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-14"
 }
}