SAML SP Single Sign On CVE-2026-61979

The miniOrange SAML SP Single Sign On plugin must be installed, active, and configured with a SAML Identity Provider on the target WordPress site - the vulnerability exists within the SAML authentication processing path and is not reachable on WordPress installations that have not configured SAML SSO. The CVSS AC:H metric indicates that beyond network reachability, exploitation requires meeting specific additional conditions, which are not detailed in the available advisory data but are likely related to the SAML binding type, assertion structure, or a timing-sensitive request sequence; these conditions limit opportunistic mass exploitation. No authentication is required (PR:N), and no user interaction is needed (UI:N), meaning exploitation is entirely attacker-driven once conditions are met. Exploitation is limited by: the requirement that the plugin be actively configured with a SAML IdP, the AC:H complexity barrier, and the absence of public exploit code at time of analysis.

The CVSS base score of 8.1 reflects a serious vulnerability, but the AC:H (High Complexity) metric meaningfully reduces real-world exploitability compared to a straightforward AV:N/AC:L scenario. AC:H indicates that exploitation is not trivially repeatable and requires specific conditions - possibly a particular SAML binding, a race condition, or a non-default configuration element within the SAML flow. No EPSS data was provided, making probabilistic exploitation likelihood unquantifiable from this dataset. The vulnerability is not listed in the CISA KEV catalog and no POC has been reported, suggesting exploitation has not yet been widely observed or automated. Despite the AC:H, the lack of any authentication requirement (PR:N) and the high-impact triad (C:H/I:H/A:H) mean that a successful exploit yields full compromise of the WordPress installation. Organizations running the plugin in enterprise SSO environments - where SAML is actively configured - should treat this as a genuine priority rather than a theoretical high-CVSS/low-real-risk finding.

An attacker who has identified a WordPress site using the miniOrange SAML SP Single Sign On plugin crafts a malformed or manipulated SAML authentication response and submits it to the plugin's Assertion Consumer Service endpoint under the specific conditions required by AC:H - such as a particular binding or timing window. The plugin incorrectly processes the privilege assignment from the assertion, elevating the attacker's session to a high-privilege WordPress role such as administrator, granting full site control without any prior credentials.