CVE-2026-28149

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability PUBLISHED

Description (CNA)

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

Vendor / product	Versions
miniOrange / Headless Single Sign On	affected n/a through 1.6

CWE-502

CISA-ADP

No English description supplied.

No references supplied.