SAML Single Sign On – SSO Login

80 Quality Score

Active Installs

18/30

A solid 10,000 active installs puts this in the upper tier of SSO plugins, though it is far behind mainstream plugins and reflects a niche enterprise audience.

Update Freshness

25/25

A perfect maintenance score is backed by an update on 2026-07-14, indicating the developer is actively shipping changes.

User Rating

15/15

A 98 out of 100 from 387 reviewers is an exceptional rating, suggesting real users have very few complaints about the core functionality.

Support Health

8/15

With 0 support threads on the WordPress.org forum, the public support channel is essentially empty, which is a real concern: most paying customers are likely funnelled to the vendor's own ticketing system rather than the community forum.

WP Compatibility

15/15

Full marks for compatibility, including tested on WordPress 7.0.1 and a PHP requirement of 5.6, which keeps it usable on older environments.

Scores higher than 79% of indexed plugins

About

SAML SSO (Single Sign On) for WordPress Login with Okta, Entra ID/Azure AD, GSuite, Salesforce & All SAML IdPs. Free Unlimited SSO [24/7 Support]

Active Installs 10k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-17 4:09am GMT

Requires WordPress 3.7+

Tested Up To 7.1.1

Requires PHP 5.6+

Security History

11 known vulnerabilities, all patched

3 Critical 4 High 4 Medium

Most recent: September 18, 2026

View details ▸

SAML Single Sign On <= 5.0.0 - Unauthenticated Privilege Escalation High

September 18, 2026 Patched in ["6.0.0"] CVE-2026-82842

SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning High

August 29, 2026 Patched in ["5.4.7"] CVE-2026-75807

SAML Single Sign On – SSO Login 4.8.85-5.4.6 - Unauthenticated Privilege Escalation High

August 19, 2026 Patched in ["5.4.7"] CVE-2026-19842

SAML Single Sign On – SSO Login <= 5.4.3 - Unauthenticated Privilege Escalation Critical

August 13, 2026 Patched in ["5.4.4"] CVE-2026-61979

SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter Critical

July 23, 2026 Patched in ["5.4.5"] CVE-2026-15981

SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion Critical

July 15, 2026 Patched in ["5.4.4"] CVE-2026-15013

SAML Single Sign On – SSO Login Premium Multisite < 20.0.7 - Open Redirect Medium

January 6, 2023 Patched in ["20.0.7"] CVE-2022-4496

SAML Single Sign On – SAML SSO Login <= 4.9.20 - Reflected Cross-Site Scripting Medium

June 6, 2022 Patched in ["4.9.21"]

SAML Single Sign On – SAML SSO Login <= 4.8.83 - Cross-Site Scripting Medium

January 28, 2020 Patched in ["4.8.84"] CVE-2020-6850

SAML Single Sign On – SAML SSO Login < 4.8.73 - Cross-Site Scripting Medium

May 27, 2019 Patched in ["4.8.73"] CVE-2019-12346

SAML Single Sign On – SAML SSO Login <= 4.8.75 - Cross-Site Request Forgery High

May 20, 2019 Patched in ["4.8.76"]

What It Does

SAML Single Sign On – SSO Login connects WordPress to an external identity provider so users log in with their existing corporate or organizational credentials rather than a separate WordPress password. It supports major IdPs including Okta, Microsoft Entra ID, Azure AD/B2C, G-Suite, Shibboleth, OneLogin, Keycloak, and Salesforce, with setup handled through a guided configuration wizard. The plugin is offered by miniOrange, a vendor that also bundles additional features (such as user role mapping and attribute mapping) behind paid tiers.

Who It's For

This plugin is a fit for organizations, schools, or businesses that already use a SAML 2.0 identity provider and want employees, students, or members to access WordPress with their existing SSO credentials. It is most useful on intranets, membership sites, or any WordPress instance where centralized identity management matters more than minimizing plugin dependencies. Non-technical admins benefit from the vendor's stated 24/7 support offering.

Who Should Skip It

If your site only needs basic passwordless or social login (Google, Facebook, etc.) and you do not have an existing SAML IdP, this plugin is overkill and you will be better served by a simpler OAuth client or a basic SSO solution. Small personal blogs, brochure sites, or anyone running a single-author site without enterprise authentication requirements will gain nothing from it.

The Bottom Line

With 10,000 installs, a 98/100 user rating, and recent updates, this is a strong SAML SSO option, but the empty public support forum means you should expect to rely on miniOrange's paid support channels if you hit trouble. Free tier users may find useful functionality gated behind premium add-ons. For anyone with an existing SAML IdP who wants a guided, vendor-supported setup, it is a safe pick; everyone else can ignore it.

Pick this instead if your identity provider is specifically Microsoft 365 and you also want deeper Microsoft Graph integration beyond just login.

OAuth Single Sign On – SSO (OAuth Client) 79/100

Choose this sibling plugin instead if you need OAuth-based social login (Google, Facebook, Apple) rather than SAML 2.0.

WP SAML Auth 78/100

Pick this lightweight, free, developer-focused alternative if you want SAML SSO without the miniOrange upsells and are comfortable editing config files.

Next Active Directory Integration 77/100

Choose this instead if your environment is on-premises Active Directory / LDAP rather than a cloud SAML IdP and you need direct directory queries.

Shibboleth 76/100

Pick this only if your institution specifically uses Shibboleth as the federated identity layer and you need a no-frills, server-side configuration approach.