# Login using WordPress Users ( WP as SAML IDP ) <= 2.0.1 - Unauthenticated Denial of Service via SAMLRequest Decompression

- **ID:** WPSEC-2026-0873
- **Plugin:** SAML IDP (Identity Provider) – Login with Website Users (`miniorange-wp-as-saml-idp`), https://wordpress.org/plugins/miniorange-wp-as-saml-idp/
- **Affected versions:** all versions before 2.0.2
- **Fixed in:** 2.0.2 (Update to 2.0.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **Weakness:** CWE-409
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/miniorange-wp-as-saml-idp
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0873/

## Description

The SAML IDP (Identity Provider) plugin for WordPress is vulnerable to Denial of Service via the SAMLRequest parameter in all versions up to, and including, 2.0.1. The plugin places no limit on the size of the Base64-encoded request or of the data produced when it is inflated with gzinflate(). This makes it possible for unauthenticated attackers to send small compressed payloads that inflate to very large sizes (a decompression bomb). Each such request uses memory up to the PHP memory limit and wastes CPU time, which can degrade the site's availability.

## References

- https://wpsec.com/vuln/WPSEC-2026-0873/
- https://plugins.svn.wordpress.org/miniorange-wp-as-saml-idp/tags/2.0.2/
- https://wordpress.org/plugins/miniorange-wp-as-saml-idp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0873/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.