Headless Single Sign On Vulnerabilities

The Headless SSO Plugin for WP plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.7.0. This is due to a flawed account-matching condition that reduced to `username_exists($userName)` regardless of the configured matcher, allowing an IdP-asserted username to match any existing...

CVSS:

7.3

(Wordfence)

Affected:

up to 1.7.0

Fixed in:

1.7.1

Disclosed:

Sep 15, 2026

CVE-2026-62108 on NVD →

The Headless Single Sign On plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is pr...

CVSS:

8.1

(Wordfence)

Affected:

up to 1.6

Fixed in:

1.6.1

Disclosed:

Aug 12, 2026

CVE-2026-28149 on NVD →

The Headless SSO Plugin for WP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

(Wordfence)

Affected:

up to 1.6

Fixed in:

1.6.1

Disclosed:

Aug 12, 2026

CVE-2026-28148 on NVD →