Headless SSO Plugin for WP icon

Headless SSO Plugin for WP

Headless SSO Plugin for WP is a WordPress plugin with the following stats:

  • #12,950 Global Rank
  • 10+ active installs
  • 5/5 1 ratings
  • Since 2021 5 years active

PF Score (About PF Scores)

PF Score is not a quality guarantee. It is a ranking based on available public signals.

Bronze52.8
Platinum
Gold
Silver
Bronze
Low

Score Breakdown

16.7
Popularity 40% 10+ active installs
61.9
Reputation 35% 5★ from 1 ratings
97.9
Freshness 25% Updated 20 days ago

No active penalty — 1 historical CVE, resolved — details

Download Trends

Loading download data…

Vulnerabilities

1 Total
1 Patched
0 Active
100% Resolved rate
CWE-502 · Deserialization of Untrusted Data

The Headless Single Sign On plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

8.1 High Affected All – 1.6 Patched in ✓ 1.6.1 Published 12 Aug 2026 CVE CVE-2026-28149

Vulnerability data provided by Wordfence Intelligence (opens in a new tab). CVE data: Copyright 1999–2026 The MITRE Corporation. CVE Terms of Use (opens in a new tab).

About Headless SSO Plugin for WP

Headless SSO Plugin allows SSO login into any frontend application React, Flutter, Angular, Gatsby, etc via WordPress and Identity Providers.

Our Headless Single Sign-On (SSO) provides one-click login into any Progressive Web App Frameworks via WordPress and IdPs with JWT Authentication.

We provide integration with SAML Single Sign-On (SAML SSO), CAS, Radius and many more which helps in providing SSO into your wordpress sites by the configured Identity Provider that allows user to authenticate and SSO into the Progressive Web Application which can be based on any Frontend technology.

WordPress Single Sign-On (SSO) with our SAML Single Sign On – SSO Login plugin allows SSO with Azure AD, Azure AD B2C, Keycloak, ADFS, Okta, Shibboleth, Salesforce, GSuite / Google Apps, Office 365, SimpleSAMLphp, OpenAM, Centrify, Ping, RSA, IBM, Oracle, OneLogin, Bitium, WSO2, NetIQ and all SAML 2.0 capable Identity Providers into your WordPress site.

Our SAML /OAuth will handle Response from the Identity provider and create the user in WordPress if it doesn’t exist, create a session of WordPress and with our JWT plugin, convert SAML Response into JWT and post on the Angular application.

Headless Mode

The headless mode allows you to disables the WP frontend experience and allows you to and let’s you integrate with any front-end frameworks like Gatsby, Vue, Angular,React, NextJS, Flutter using REST API. This allows you to use WordPress only for managing the content and fetch the content in the frontend environment via APIs.

Features Include

Single Sign-On Integration: miniOrange provides Single Sign-On (SSO) integrations with all types of protocols like SAML, OAuth2.0, OpenID connect, CAS, LDAP, WS-Fed, Radius, etc.

Frontend technology Support: Easy to Configure : It allows any Frontend technology like React JS, Angular JS, Flutter, Gatsby banking on Headless WordPress to be able to Single Sign-On via the described Identity Providers.

JWT Signing: Support for Signing JWT token using algorithms like HS512, RS512, etc.

Attribute Mapping: Get user attributes from your Provider and map them to WordPress user attributes like firstname, last name with support for custom attributes

Link to add IDP Login: Add a link anywhere on your frontend to allow users to authenticate via their Identity Provider

Multiple IDP Support: Configure multiple IDPs to perform Single Sign-On (SSO) into WordPress

Stateful and Stateless session Support: Allows maintaining session on only frontend, only WordPress or both.

Protect Your Complete Site: Restrict your WordPress site to only logged-in users by redirecting the users to your Identity Provider if logged in session is not found

Code for Signature Verification: Code templates for JWT signature verification in all frontend technologies (React JS, Angular JS, Flutter, Gatsby, Vue, etc.)

Existing User store integrations (SSO): Provides real time Headless Single Sign-On(SSO) access for users without having to move users from their existing user stores.

Unauthorized error message when accessing front-end: The Headless mode option displays a 403 Unauthorized error message when users access the frontend of your website. If the users want to access the WordPress backend, they can do so by visiting ‘site_url/wp-login.php’

Redirect non-logged users trying to access the site: The Headless mode option redirects the non-logged in users to the WordPress login screen so that the access to the frontend is disabled. Logged-in users are redirected to the editor screen for the post which allows sharing a readable link straight to the editor so that they can easily edit the post.

Why people prefer miniOrange Headless SSO

Support for Customization: Customization in the Single Sign-On (SSO) flow based on your customized IDP or additional requirements.

Cost-effective: Get access to Headless SSO with saving cost and time avoiding password fatigue with streamlining the user experience and adoption rates more.

24/7 Active Support: We provide world-class support and customers vouch for our support, ensuring you best services all the time.

Use Cases

Login into Gatsby / Gatsby SSO login: The app based on Gatsby’s endpoint needs to be entered in the WordPress Headless SSO Plugin.
The Authentication request from WordPress is redirected to the Identity Provider, and complete authentication process occurs at IdP end. The plugin receives a SAML / OAuth Response from the IdP. A signed JWT response is sent to Gatsby via WordPress Headless SSO plugin.

Login into AngularJS App / Angular js app login (SSO):
We introduced Angular SSO using Azure AD as identity Provider (IDP). We have configured SSO with Azure AD on our WordPress site backend using WordPress SSO Plugin .Websites use WordPress as a headless CMS so we can’t use SSO widget or buttons on the frontend to initiate SSO. Integrating Single Sign-On (SSO) functionality for your Headless WordPress environment allows your users to enable SSO login for any Headless decoupled frontend framework like AngularJS clubbed with WordPress backend using a single set of login credentials of your IDP Azure AD.

We also offer Headless SSO into various frontend technologies like:

  • Login into Flutter / Flutter App Login (Headless SSO)

  • Login into Vue / Vue App Login (Headless SSO)

  • Login into React / React App Login (Headless SSO)

Documentation

Our Headless SSO plugin for WordPress – Headless SSO plugin for WordPress comes with detailed guidelines with ensured content, expectations to make sure you don’t get lost along the way.
https://plugins.miniorange.com/wordpress-headless-sso

Contact Support

If you are still nervous about your website security or how the plugin would work for you specifically, customized solutions and Active support are available. You can always Contact Us, or Email us at [email protected] and we would be happy to help you out.

Website

Check out our website for other plugins http://miniorange.com/plugins or click here to see all our listed WordPress plugins.
For more support or info email us at [email protected] or Contact us.

Screenshots

WP Headless SSO | Workflow | Web app frameworks authentication.

WP Headless SSO | Workflow | Web app frameworks authentication.

Ratings & Reviews

Recent Reviews

Loading reviews…

View all reviews on WordPress.org (opens in a new tab)

Changelog

1.6.1

  • Fixed SAML authentication bypass security issue

1.6

  • Added compatibility with WordPress 7.0
  • Fixed redirect issue when clicking on the Service Provider tab

1.5

  • Added Compatibility with WordPress 6.8

1.4

  • Added SAML SSO Support
  • Updated plugin’s UI

1.3

  • Enable Headless CMS Mode
  • Added Support form and feedback form
  • WordPress 5.9 Compatibility

1.2

  • Bug fixes
  • Readme Updates
  • WordPress 5.8 Compatibility

1.1

  • Updated Plugin description

1.0

  • This is the first release

Alternatives to Headless SSO Plugin for WP

Other WordPress plugins serving a similar purpose, ranked by relevance and PF Score.

Platinum85.2
SAML Single Sign On – SSO Login icon

SAML Single Sign On – SSO Login

Enable SAML Single Sign On for WordPress with support for multiple enterprise identity providers.

★ 4.9/5·10K+ installs·Updated 14 Aug 2026
Gold83.8
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) icon

WPO365

Connects WordPress to Microsoft Entra, Microsoft 365, and SharePoint with single sign-on and role sync capabilities.

★ 4.9/5·10K+ installs·Updated 23 Jul 2026
Gold76.2
Log in with Google icon

Log in with Google

Minimal plugin that allows WordPress users to log in using Google.

★ 4.6/5·6K+ installs·Updated 13 Aug 2026
Gold74.3

OneLogin SAML SSO

Integrates SAML-based single sign-on with WordPress to streamline user authentication through external identity providers.

★ 4.4/5·7K+ installs·Updated 1 Jul 2026
Gold73.6
SAML IDP (Identity Provider) – Login with Website Users icon

SAML IDP (Identity Provider)

Single sign on (SSO) login with WordPress Users into any Service Provider like Tableau, Thinkific, Zoom, Moodle LMS, Canvas LMS,…

★ 4.8/5·600+ installs·Updated 3 Aug 2026
Gold71.2
Next Active Directory Integration icon

Next Active Directory Integration

Next Active Directory Integration allows WordPress to authenticate, authorize, create and update users against Microsoft Active Directory.

★ 4.8/5·2K+ installs·Updated 22 May 2026
Silver68.9
WP Discourse icon

WP Discourse

This plugin allows you to use Discourse as a community engine for your WordPress website. The plugin is not a…

★ 4.5/5·1K+ installs·Updated 13 Aug 2026
Silver68.7
Login for Google Apps icon

Login for Google Apps

Simple secure login and user management through your Google Workspace for WordPress (using oAuth2 and MFA if enabled).

★ 4.6/5·10K+ installs·Updated 8 May 2025
Silver66.2

SSO for Entra ID

Enable Single Sign On with Microsoft Entra ID (formerly Azure AD) on your site.

★ 5/5·600+ installs·Updated 4 Jul 2026
Silver65.0
Webo-facto icon

Webo-facto

Utiliser l'extension "Webo-facto" pour lier votre site WordPress à votre espace de travail dans le webo-facto.

1K+ installs·Updated 9 Jul 2026