Headless Single Sign On
Monthly
Unauthenticated attackers can bypass the authentication logic of the miniOrange Headless Single Sign On WordPress plugin at versions up to and including 1.7.0, gaining access as arbitrary users - potentially administrators - with full confidentiality, integrity, and availability impact (CVSS 3.1 9.8). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no credentials, no user interaction, and no client-side prerequisites against an affected installation; the practical limiting factor is deployment, since this is a niche headless-SSO component with a modest install footprint, and the precise configuration state that triggers the bypass is not described in the advisory. At time of analysis there is no CISA KEV entry and no public exploit identified, so the risk is driven by the severity of the flaw and the ease of the network attack path rather than by observed exploitation. Reported by Patchstack (EUVD-2026-81491).
Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated attackers can bypass the authentication logic of the miniOrange Headless Single Sign On WordPress plugin at versions up to and including 1.7.0, gaining access as arbitrary users - potentially administrators - with full confidentiality, integrity, and availability impact (CVSS 3.1 9.8). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no credentials, no user interaction, and no client-side prerequisites against an affected installation; the practical limiting factor is deployment, since this is a niche headless-SSO component with a modest install footprint, and the precise configuration state that triggers the bypass is not described in the advisory. At time of analysis there is no CISA KEV entry and no public exploit identified, so the risk is driven by the severity of the flaw and the ease of the network attack path rather than by observed exploitation. Reported by Patchstack (EUVD-2026-81491).
Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.