CVE-2022-4496: miniorange miniorange wordpress saml sso premium Open Redirect
Vulnerability summary
CVE-2022-4496 is a medium (CVSS 6.1) Open Redirect vulnerability in miniorange miniorange wordpress saml sso premium. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.5% of scored vulnerabilities. 3 public exploits are recorded. Fixed in 16.0.8, 12.1.0 and 20.0.7.
Timeline
- 30-01-2023PublishedVulnerability first disclosed.
- 28-03-2025Last modifiedVulnerability information updated.
Description
The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- wordfenceSource6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.61% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (wpscan.com)
Maturity: unknown
Exploit Reference (wpscan.com)
Maturity: unknown
Exploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Miniorange4 products
- miniorange wordpress saml sso premium≥ 12.0.0, < 12.1.0
- miniorange wordpress saml sso premium mulsitesite≥ 20.0.0, < 20.0.7
- miniorange wordpress saml sso standard≥ 16.0.0, < 16.0.8
- saml_sp_single_sign_on≥ 12.0.0, < 12.1.0 | ≥ 16.0.0, < 16.0.8 | ≥ 20.0.0, < 20.0.7
Wordpress1 product
- miniorange-saml-20-single-sign-on≥ 16, < 16.0.8 | ≥ 12, < 12.1.0 | ≥ 20, < 20.0.7
2 vendors · 5 products
References
4 links- wpscan.com/vulnerability/af2e30c7-0787-4fe2-97ee-bc616f7178a1ExploitVDB EntryTechnical DescriptionThird Party Advisory
- wpscan.com/vulnerability/be21f355-0e5b-4ad7-9d8f-85e9a0101ddcExploitVDB EntryTechnical DescriptionThird Party Advisory
- wpscan.com/vulnerability/e6c4c8c7-1dcd-45bf-8582-f12accca6facExploitVDB EntryTechnical DescriptionThird Party Advisory