WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Description

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

Affected Products

Vendor	Product	Versions
miniorange	headless single sign on	n/a

References

https://patchstack.com/database/wordpress/plugin/headless-single-sign-on/vulnerability/wordpress-headless-single-sign-on-plugin-1-6-php-object-injection-vulnerability?_s_id=cve(vdb-entry)

Related News (1 articles)

Tier C

VulDB12d ago

CVE-2026-28149 | miniOrange Headless Single Sign On Plugin up to 1.6 on WordPress injection

→ No new info (linked only)

CVSS 3.19.8 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

CWECWE-502

PublishedAug 13, 2026

Trending Score11

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-61979EXPKEV

WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

Trending: 119

CRITICALCVE-2026-28148

WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

Trending: 11

CRITICALCVE-2026-61967

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Trending: 11

CRITICALCVE-2026-28008

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

Trending: 11

HIGHCVE-2026-73351

WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability

Trending: 10

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Aug 13, 2026

Discovered by ZDM

Aug 13, 2026