What is the CVSS score of EUVD-2026-116774?

EUVD-2026-116774 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate EUVD-2026-116774?

Within 24 hours, inventory all WordPress instances running the miniOrange SAML SP Single Sign On plugin (versions through 6.1.0) and confirm whether the SAML SSO endpoint is internet-facing; enable rate limiting or WAF rules to throttle abusive request patterns at the edge, and monitor for availability anomalies. Within 7 days, if the plugin is not essential, disable and remove it; otherwise isolate the SAML endpoint behind a reverse proxy with request-size and connection limits, and validate that all authentication flows still function. Within 30 days, monitor the vendor's advisory for an updated release, test any patch in staging before production rollout, and document compensating controls if the plugin remains in service.

miniOrange SAML SP EUVD-2026-116774

| CVE-2026-62126 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-11-04 Patchstack

GHSA-q866-82pg-8qrm

WordPress Denial Of Service Wordpress Plugin Saml Sp Single Sign On Miniorange

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach SAML SSO HTTP endpoint
Delivery

Send crafted/unbounded request
Exploit

Trigger unthrottled resource allocation
Execution

Exhaust server resources
Impact

Site unavailable (DoS)

Vulnerability Assessment

Weakness	CWE CWE-770 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource allocation limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the miniOrange SAML SP Single Sign On plugin (versions through 6.1.0) be installed and its SAML SSO HTTP endpoint be reachable by the attacker; per the CVSS vector it needs no authentication (PR:N), no user interaction (UI:N), and only low complexity (AC:L), so any internet-exposed site running the affected plugin is reachable. The specific feature, parameter, or request pattern that triggers the unthrottled allocation is not described in the available sources. Limiting factors: impact is availability-only (C:N/I:N) - it cannot expose or alter data - and only sites that have this particular SSO plugin enabled and exposed are affected.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated resource-exhaustion flaw whose only impact is availability - consistent with CWE-770 (Allocation of Resources Without Limits or Throttling) and the stated 'HTTP DoS' effect. No EPSS probability was supplied, and the vulnerability is NOT in CISA KEV, so there is no_public_exploit identified as weaponized and no evidence of active exploitation; a public PoC reference exists via Patchstack but it is not verified as working exploit code. The vuln.today decision label is 'this_week', which positions this as a prioritize-but-not-emergency item rather than an act_now/emergency case. Signals are internally consistent (network vector matches an HTTP DoS against a WordPress plugin), so there is no CVSS-vs-description conflict; the main caveat is that EPSS is absent, so widespread-exploitation likelihood cannot be quantified from the input. Net: a genuine but availability-only issue - meaningful for sites exposing this SSO endpoint, but it cannot be used to breach confidentiality or integrity.
Exploit ScenarioDerived	A remote, unauthenticated attacker sends crafted or high-volume HTTP requests to the plugin's SAML SSO endpoint, causing it to allocate resources without limit and exhaust server capacity, rendering the WordPress site unavailable. A public PoC reference exists (Patchstack); it is not verified as working exploit code, and no active exploitation is confirmed. The CVSS AV:N/AC:L/PR:N/UI:N vector indicates this requires no authentication, no user interaction, and only low attack complexity.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Nov 04, 2026

Unauthenticated resource exhaustion in the miniOrange SAML SP Single Sign On WordPress plugin (versions through 6.1.0) lets remote attackers drive an HTTP denial-of-service against sites that expose the plugin's SAML SSO endpoint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 7.5) confirms the attack needs no credentials, no user interaction and only low complexity, but the impact is availability-only - confidentiality and integrity are unaffected. No public exploit code has been identified at time of analysis, and the vulnerability is tracked for remediation this week per the current priority label; the specific request pattern that triggers the unthrottled allocation is not described in the available sources.

RemediationAI

No vendor-released patch was identified at time of analysis, and the available advisory does not list a fixed version, so there is no confirmed upgrade target to cite; monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/miniorange-saml-20-single-sign-on/vulnerability/wordpress-saml-sp-single-sign-on-plugin-6-1-0-denial-of-service-attack-vulnerability?_s_id=cve for a patched release and apply it as soon as one is published. Because the assessed exploitation condition is reachability of the plugin's SAML SSO HTTP endpoint, the concrete compensating control is to reduce that exposure - block or allow-list access to the SAML endpoints at the edge or WAF and apply request throttling there, with the trade-off that external identity-provider callbacks and end-user SSO logins will fail for any client that is filtered or rate-limited. Sites that cannot restrict the endpoint should consider disabling the plugin until a fix is available, accepting the loss of SAML single sign-on for their users.

Affected VersionsENISA

SAML SP Single Sign On 0 ≤6.1.0

Affected Packages

euvd saml_sp_single_sign_on no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is CWE-770 (Allocation of Resources Without Limits or Throttling) in a WordPress SAML Service Provider plugin, miniOrange SAML SP Single Sign On, identified by CPE cpe:2.3:a:miniorange:saml_sp_single_sign_on with all versions up to and including 6.1.0 in scope. A SAML SP is the relying-party component that receives and processes SAML assertions from an identity provider, typically exposing HTTP endpoints for assertion consumer services, metadata and login initiation; those endpoints must be reachable by browsers, which is why the assessed exploitation condition is simply that the plugin is installed and its SAML SSO HTTP endpoint is internet-reachable. The vulnerability class means some code path consumes resources (memory, connections, CPU or similar) in response to attacker-driven requests without an enforced cap or throttle, producing the stated HTTP denial-of-service. Consistent with the CVSS vector, no authentication (PR:N), no user interaction (UI:N) and low attack complexity (AC:L) are required, and the scope is unchanged with availability as the only impacted property. The trigger - the specific feature, parameter or request pattern that causes the unbounded allocation - is not described in the available sources, so the exact mechanism should be confirmed against the Patchstack advisory and the plugin code before building detections.

Know when Saml Sp Single Sign On gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Unauthenticated remote HTTP request reaches the SSO endpoint (AV:N/AC:L/PR:N/UI:N); resource exhaustion yields availability-only impact (A:H, C:N/I:N) with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0.

Articles & Coverage 1

News 13 New WordPress Vulnerabilities - 13 High Severity, No POC Available Nov 04, 2026

Executive ViewAI

Why It Matters

CVE-2026-62126 is a high-severity unauthenticated denial-of-service vulnerability in the miniOrange SAML SP Single Sign On WordPress plugin affecting all versions through 6.1.0. It allows any remote attacker to exhaust server resources and take down SAML-protected WordPress sites, disrupting authentication for employees, partners, and customers who rely on single sign-on. Leadership should care because an outage could halt access to critical business applications and damage customer trust, even though no data breach or integrity impact is involved.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include enforcing rate limiting and connection throttling on the SAML SSO endpoint, deploying WAF rules to block anomalous request bursts, restricting endpoint exposure to trusted identity provider networks where feasible, and monitoring for HTTP exhaustion patterns.

Threat Intelligence Overview

EPSS Score

0.3%

Top 82% exploitable

Prevalence

Medium

WordPress SSO plugin; common but installed on a subset of sites

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.