{
 "id": "WPSEC-2026-2176",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2176/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2176/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2176/index.md",
 "title": "SAML Single Sign On <= 6.1.0 - Unauthenticated Denial of Service via SAML Response Signature Transforms",
 "description": "The SAML Single Sign On plugin for WordPress is vulnerable to Denial of Service via the SAMLResponse parameter in all versions up to, and including, 6.1.0. This is due to the plugin canonicalizing SignedInfo, validating references and processing arbitrary signature transforms, including attacker-supplied XPath transform expressions, before any cryptographic signature verification, with no limit on the size of the submitted response. This makes it possible for unauthenticated attackers to submit crafted SAML responses that consume excessive server resources and degrade or deny service to the site.",
 "plugin": {
  "slug": "miniorange-saml-20-single-sign-on",
  "name": "SAML Single Sign On",
  "full_name": "SAML Single Sign On – SSO Login",
  "wordpress_org": "https://wordpress.org/plugins/miniorange-saml-20-single-sign-on/",
  "advisories_url": "https://wpsec.com/vuln/plugin/miniorange-saml-20-single-sign-on/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/miniorange-saml-20-single-sign-on"
 },
 "type": "DOS",
 "cwe": [
  "CWE-400"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.2.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.2.0",
 "remediation": "Update to 6.2.0 or later.",
 "fix_released": "2026-10-30T06:50:57+00:00",
 "published": "2026-10-31T07:44:03+00:00",
 "updated": "2026-10-30T09:24:59.582256+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2176/",
  "https://plugins.svn.wordpress.org/miniorange-saml-20-single-sign-on/tags/6.2.0/",
  "https://wordpress.org/plugins/miniorange-saml-20-single-sign-on/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/miniorange-saml-20-single-sign-on",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-31"
 }
}