An allocation of resources without limits or throttling flaw in the WordPress SAML SP Single Sign On plugin enables an attacker to trigger a denial‑of‑service condition via crafted HTTP requests. The weakness allows the attacker to exhaust server resources, interrupt legitimate authentication traffic, and degrade service availability. No data breach or code execution is implied by the description, so the impact is confined to availability control compromise.

The vulnerability is limited to the miniOrange SAML SP Single Sign On plugin released through version 6.1.0. Administrators running WordPress sites with the legacy plugin are exposed; upgrades beyond 6.1.0 are not affected.

The CVSS score of 7.5 indicates a moderate to high severity, and the EPSS score is not available, so a precise exploitation probability cannot be derived. The vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of in‑the‑wild exploitation. Attackers possess a relatively low barrier to entry, needing only the ability to submit HTTP traffic to the affected endpoint. Without any obvious mitigations in place, the scenario is feasible for automated high‑volume DoS attacks.