Description

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T14:16:58.070Z",
  "pubdate": "2026-08-13T14:16:58.070Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the Headless Single Sign On plugin affecting versions 1.6 and below. This security flaw arises from the insecure handling of user-supplied serialized data within the application logic, allowing remote attackers to supply maliciously crafted inputs. The primary impact of this vulnerability includes potential Remote Code Execution, unauthorized data access, or arbitrary file manipulation, depending on the presence of suitable gadget chains within the application's execution context or loaded third-party libraries. Affected systems include any WordPress installations utilizing the vulnerable versions of the Headless Single Sign On product. The risk implications are severe, as the vulnerability requires no prior authentication or administrative privileges, significantly lowering the barrier to entry for malicious actors. Exploitation requirements are minimal, typically involving direct network access to the target web application endpoint responsible for processing the insecure deserialization routine. Consequently, unauthenticated attackers can leverage this weakness to completely compromise the underlying web server, escalate privileges, or pivot deeper into internal network segments, representing a critical security risk that demands immediate remediation.",
  "technicalDetails": "The vulnerability is rooted in the insecure deserialization of untrusted data handled by the Headless Single Sign On product. Specifically, the vulnerable component processes serialized PHP objects via native functions such as unserialize() without properly sanitizing or validating the input data before instantiation. This allows a remote, unauthenticated attacker to inject arbitrary serialized PHP object payloads via network exposure vectors into the vulnerable application.\nThe attack flow begins when an attacker crafts a malicious serialized payload containing specific object gadget chains. These chains leverage existing classes defined within the application or included plugins and themes to trigger unintended method invocations during the object resurrection process, particularly via magic methods such as __wakeup() or __destruct().\nOnce the crafted payload is transmitted to the vulnerable endpoint, the application deserializes the input, instantiating the attacker-controlled objects. As the PHP runtime processes these objects, the embedded gadget chains execute, leading to unsafe operations. Depending on the available gadgets within the environment, post-exploitation impact can manifest as Remote Code Execution, arbitrary file deletion, or database interaction bypass.\nThe affected versions include Headless Single Sign On <= 1.6. The vulnerability requires no authentication or privilege requirements, operating entirely via network exposure against externally accessible HTTP endpoints. Because the flaw permits unauthenticated execution paths, remediation necessitates immediate code-level intervention to eliminate insecure deserialization routines or implement robust cryptographic signing and validation of serialized data."
}