CVE-2026-28148

The 9.8 severity rating on CVE-2026-28148 demands immediate skepticism before you treat it as a standard emergency. The EPSS score of 0.00239 translates to roughly a 0.24% probability of exploitation within 30 days — far below the threshold most organizations use for urgent patching. This gap is not a scoring anomaly; it's a structural feature of how EPSS calibrates for authentication bypasses in headless SSO plugins, and understanding why matters for your prioritization decision. The plugin mediates API-to-API authentication flows rather than browser-based logins. This creates a counterintuitive risk profile: the attack surface is technically narrower because exploitation requires programmatic API calls rather than casual scanning, but the blast radius if exploitation succeeds is concentrated at a critical trust chokepoint. When a plugin issues identity assertions that other services honor — think Salesforce, Azure AD, Okta integrations — you're not compromising a blog; you're potentially gaining a valid token that downstream systems accept without question. The CVSS 9.8 captures that worst-case blast radius. The EPSS undercount reflects a telemetry gap: honeypots and crawlers that feed EPSS don't see attacks against specialized authentication middleware because those attacks don't generate the web-visible traffic patterns the sensors are designed to catch. Here's what to do. First, determine whether this plugin sits in an active authentication chain — if it mediates SSO between WordPress and any identity provider, treat the blast radius as the governing risk factor, not the exploitation probability. Second, audit every service that consumes identity assertions from this plugin; the vulnerability lives in the middleware, but the exposure lives downstream. Third, recognize that the EPSS probability will shift once a public PoC emerges — the current score reflects pre-disclosure telemetry, not post-disclosure threat evolution. The 30-day window is a snapshot, not a steady state. The pattern is documented: authentication bypasses in WordPress SSO plugins have a history of low EPSS scores followed by exploitation clusters 6-18 months later, when attackers move from research to targeted campaigns that don't generate the opportunistic signatures EPSS weights for. Your remediation timeline should account for that lag, not the current probability.

Reviewed through automated stages and approved by a human before publication.