What is the CVSS score of CVE-2026-61979?

CVE-2026-61979 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SAML SP Single Sign On are affected by CVE-2026-61979?

The miniOrange SAML SP Single Sign On WordPress plugin (versions 5.4.3 and earlier) contains an unauthenticated privilege escalation vulnerability enabling attackers to gain administrator-level…

How to fix or mitigate CVE-2026-61979?

Within 24 hours: Identify all WordPress instances running miniOrange SAML SP plugin version 5.4.3 or earlier and immediately deactivate or remove the plugin. Within 7 days: Review WordPress administrator activity logs from the past 30 days for unauthorized access; implement IP-based access controls and rate limiting on wp-admin endpoints; audit all SAML configuration settings. Within 30 days: Complete evaluation of alternative SAML SSO solutions and perform security testing before deploying replacement authentication mechanisms.

SAML SP Single Sign On CVE-2026-61979

EUVD-2026-57976 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-08-13 Patchstack

GHSA-p92r-62jh-8r5w

WordPress Privilege Escalation Wordpress Plugin Saml Sp Single Sign On Miniorange

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-exposed SAML endpoint, no authentication needed, but AC:H reflects specific conditions required; full C/I/A justified by administrator-level takeover potential.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:45 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

AnalysisAI

Unauthenticated privilege escalation in the miniOrange SAML SP Single Sign On WordPress plugin (versions ≤ 5.4.3) allows network-accessible attackers to elevate their privileges without any prior authentication. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates exploitation is remotely achievable but requires specific conditions to be met - likely particular SAML configuration states or timing-sensitive request manipulation. Full confidentiality, integrity, and availability impact is reported, consistent with an attacker reaching WordPress administrator-level access. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected product is the miniOrange SAML SP Single Sign On WordPress plugin (CPE: cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:*:*:*:*), which implements the SAML 2.0 Service Provider role to enable federated single sign-on for WordPress sites. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly assigns roles or capabilities during the SAML authentication response processing. In a SAML SP flow, the plugin receives and parses assertions from an Identity Provider; a flaw in how user roles are mapped or validated from assertion attributes could allow a crafted or replayed assertion to claim higher privileges than intended - potentially granting WordPress administrator or editor roles without a legitimate IdP backing them.

RemediationAI

The primary fix is to update the miniOrange SAML SP Single Sign On plugin to a version above 5.4.3 as soon as a patched release is available from the WordPress plugin repository or the miniOrange vendor site; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/miniorange-saml-20-single-sign-on/vulnerability/wordpress-saml-sp-single-sign-on-plugin-5-4-3-privilege-escalation-vulnerability for the confirmed fix version once published. If upgrading immediately is not possible, a direct compensating control is to disable the SAML SSO plugin entirely until the patch is applied - this eliminates the attack surface at the cost of disrupting federated login for all SAML-authenticated users. An additional defensive measure is to restrict access to SAML SP endpoints (e.g., the plugin's ACS URL) at the web application firewall or reverse proxy layer to known Identity Provider IP ranges only, reducing exposure from arbitrary external actors while preserving SSO functionality for legitimate IdP traffic. Note that neither workaround addresses the underlying privilege assignment flaw and patching remains the authoritative remediation.