Unauthenticated PHP Object Injection in Headless Single Sign On

Executive Summary

CVE-2026-28149 is an unauthenticated PHP Object Injection vulnerability in the Headless Single Sign On WordPress plugin versions 1.6 and below. This flaw allows attackers to inject malicious PHP objects into the application, potentially leading to code execution, SQL injection, or other attacks if a suitable POP chain exists.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if the Headless Single Sign On plugin version 1.6 or below is installed. Inspect WordPress installations for the plugin directory and version. No specific commands are provided in the context, but monitoring for unusual activity or unauthorized access attempts may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code, manipulate databases, access sensitive data, or disrupt services on your website. Since it is unauthenticated, attackers do not need credentials to exploit it, making it highly dangerous for unpatched versions.

Useful 0 Not Useful 0

Compliance Impact

Exploitation could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. This may result in legal penalties, reputational damage, and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Headless Single Sign On plugin to version 1.6.1 or later. If updating is not possible, apply the Patchstack mitigation rule to block attacks until an update is applied. Enable auto-updates for vulnerable plugins if using Patchstack.

Useful 0 Not Useful 0