The vulnerability is an unauthenticated PHP Object Injection flaw found in the miniOrange Headless Single Sign On plugin for WordPress versions up to and including 1.6. The flaw allows an attacker to create serialized PHP objects that are later unserialized by the plugin without proper authentication or validation. Successful exploitation can lead to arbitrary code execution, allowing full control over the affected WordPress site. The weakness is classified as CWE-502 and carries a CVSS score of 9.8, underscoring its criticality for confidentiality, integrity, and availability.

The issue affects the miniOrange Headless Single Sign On plugin for WordPress, specifically all released versions up to 1.6. This includes installations configured to expose its single sign‑on functionality. Users running a version later than 1.6.1 are not impacted, as the update addresses the injection flaw.

The CVSS rating of 9.8 signals an extremely high severity. Although EPSS is not available and the vulnerability is not listed in CISA's KEV catalog, the risk remains significant. The flaw can be leveraged without authentication when an attacker can send crafted serialized data to the plugin's interfaces, most likely the headless authentication API or configuration endpoints that accept serialized payloads. While no public exploit is currently known, the vulnerability’s nature means that it is theoretically readily exploitable by a skilled adversary.