Headless Single Sign On
Monthly
Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.