miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login
Priority LOW 28Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0061 49th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA
Fix Fixed miniOrange WordPress SAML SSO Standard (miniOrange): 16.0.8miniOrange WordPress SAML SSO Premium (miniOrange): 12.1.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| miniOrange | miniOrange WordPress SAML SSO Standard | 16.0.0 to before 16.0.8 | 16.0.8 | Patch available | CNA |
| miniOrange | miniOrange WordPress SAML SSO Premium | 12.0.0 to before 12.1.0 | 12.1.0 | Patch available | CNA |
| miniOrange | miniOrange WordPress SAML SSO Premium MulsiteSite | 20.0.0 to before 20.0.7 | 20.0.7 | Patch available | CNA |
- miniOrange WordPress SAML SSO Standard VendorminiOrange Affected 16.0.0 to before 16.0.8 Fixed in 16.0.8 Patch available CNA
- miniOrange WordPress SAML SSO Premium VendorminiOrange Affected 12.0.0 to before 12.1.0 Fixed in 12.1.0 Patch available CNA
- miniOrange WordPress SAML SSO Premium MulsiteSite VendorminiOrange Affected 20.0.0 to before 20.0.7 Fixed in 20.0.7 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:premium:wordpress:*:* | 12.0.0 to before 12.1.0 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:standard:wordpress:*:* | 16.0.0 to before 16.0.8 | Vulnerable | miniOrange |
| cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:multisite:wordpress:*:* | 20.0.0 to before 20.0.7 | Vulnerable | miniOrange |
- cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:premium:wordpress:*:* Versions 12.0.0 to before 12.1.0 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:standard:wordpress:*:* Versions 16.0.0 to before 16.0.8 Vulnerable ·miniOrange
- cpe:2.3:a:miniorange:saml_sp_single_sign_on:*:*:*:*:multisite:wordpress:*:* Versions 20.0.0 to before 20.0.7 Vulnerable ·miniOrange
Remediation
- Fix · CNA miniOrange WordPress SAML SSO Standard (miniOrange) Fixed in 16.0.8
- Fix · CNA miniOrange WordPress SAML SSO Premium (miniOrange) Fixed in 12.1.0
- Fix · CNA miniOrange WordPress SAML SSO Premium MulsiteSite (miniOrange) Fixed in 20.0.7
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4496
- 2026-10-03 Alias added: GHSA-rcxh-cxjx-w475
References
More miniOrange Saml Sp Single Sign On vulnerabilities
- TI-2020-05556 Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress… CVSS 3.1MEDIUM 6.1
- TI-2019-09196 In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2022-4496 · CVE Program
- CVE-2022-4496 · NVD
- FIRST EPSS
- GHSA-rcxh-cxjx-w475 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences