EUVD-2026-57947
GHSA-p43p-3gc5-7925
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote request reaches unserialize() with no interaction (AV:N/AC:L/PR:N/UI:N); object injection to RCE yields full C:H/I:H/A:H, though realized impact hinges on gadget availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
Articles & Coverage 1
AnalysisAI
Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site.
Technical ContextAI
The vulnerability is a CWE-502 Deserialization of Untrusted Data issue in the plugin's PHP code, where user-supplied input reaches PHP's unserialize() without validation. When PHP unserializes attacker-controlled data, it can instantiate arbitrary objects whose magic methods (__wakeup, __destruct, __toString) fire automatically; chaining these across the plugin, WordPress core, or bundled libraries forms a POP gadget chain that can achieve file writes, SQL execution, or code execution. The affected component is cpe:2.3:a:miniorange:headless_single_sign_on, a WordPress plugin that brokers single sign-on, so the injection point is exposed to unauthenticated web requests handling SSO tokens or callbacks. The realized impact depends on which usable gadget chains are present in the specific WordPress environment.
RemediationAI
No vendor-released patch version was identified in the available data; the input confirms versions up to 1.6 are affected but does not name a fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/headless-single-sign-on/vulnerability/wordpress-headless-single-sign-on-plugin-1-6-php-object-injection-vulnerability) and the WordPress plugin repository for an update newer than 1.6 and apply it once available. Until a patched version is confirmed, the strongest compensating control is to deactivate and remove the Headless Single Sign On plugin, accepting that SSO login will break for users. If removal is not feasible, place the site behind a WordPress-aware WAF (e.g., Patchstack or equivalent) with a virtual patch for this object-injection rule, and restrict access to the plugin's SSO callback/endpoint URLs via IP allowlisting or authentication at the web-server layer - noting this may block legitimate identity-provider callbacks and must be tested against your SSO flow.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today