CVE-2026-28149

The CVSS 9.8 rating for this unauthenticated PHP Object Injection in a headless WordPress SSO plugin is technically accurate for the vulnerability class, but it masks a critical nuance: successful exploitation depends on available gadget chains in the target environment. WordPress core provides limited chains, but the plugin ecosystem dramatically shifts the practical exploitability landscape—an attacker needs to understand what other plugins are present to construct a viable path to RCE. This makes mass exploitation harder but targeted attacks entirely feasible, especially in headless architectures that typically run multiple supporting plugins. The headless SSO context creates a structurally concerning position. These plugins bridge authentication flows between decoupled WordPress backends and front-end frameworks, processing tokens that travel across systems with different security models. Compromising this plugin doesn't just give you RCE on WordPress—it potentially lets you acquire or forge tokens the front-end framework considers valid, expanding the blast radius beyond the WordPress host to the entire authentication layer across both systems. The EPSS of 0.00386 indicates low automated detection, meaning defenders may not know this plugin exists in their environment. PHP-focused scanners often aren't part of headless architecture toolchains. This creates a monitoring gap: the vulnerability is real, but likely unflagged in standard scans. Priorities for defenders: First, determine whether this plugin is in your environment—it may not appear in typical PHP scanner output. Second, audit what other plugins are installed to assess gadget chain exposure. Third, evaluate whether the headless architecture can shift authentication handling to infrastructure-level solutions with smaller attack surfaces. Fourth, verify active maintenance status—headless SSO plugins often have longer refresh cycles, and abandoned code at authentication boundaries creates extended exposure windows. The gap between CVE publication and actual patching in production for this plugin category typically exceeds the standard 30-60 day window.

Reviewed through automated stages and approved by a human before publication.