CVE-2026-15964 in Single Sign On for TNG Plugin
Summary
by MITRE • 08/01/2026
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in the Single Sign On For TNG plugin for WordPress represents a critical authentication bypass flaw that allows unauthenticated attackers to reset passwords for any user account on the affected WordPress site. This weakness exists in all versions up to and including 2.0.0, making it a widespread issue affecting numerous installations. The vulnerability stems from the improper implementation of the password reset functionality within the plugin's ajax handling mechanism. The core technical flaw resides in the `ssoprocess_ajax()` function which is registered to handle ajax requests without requiring authentication through the `wp_ajax_nopriv_ssoprocess_ajax` hook, making it accessible to any visitor regardless of their authentication status.
The operational impact of this vulnerability extends far beyond simple account compromise, as attackers can leverage this flaw to gain complete administrative control over affected WordPress installations. The vulnerability operates by accepting an attacker-supplied email parameter with the `setnewpassword` operation and directly calling the `reset_password()` function on the resolved user account without implementing any form of ownership verification or authorization checks. This means that an attacker needs only to know a valid email address associated with a WordPress user account to initiate a password reset request, effectively bypassing all standard WordPress security mechanisms designed to prevent unauthorized access to user accounts.
The security mechanism that fails in this implementation provides no meaningful protection against unauthorized access attempts. The only apparent guardrail is the `check_ajax_referer()` function call, which offers absolutely no authorization barrier due to the nonce being publicly exposed through the `wp_localize_script()` function on every front-end page. This JavaScript object named `SSOPWDREQUIREMENT` contains the `ssoajaxnonce` value that WordPress computes for logged-out visitors against a shared anonymous session context. Since nonces for unauthenticated users are generated using a common session state rather than individual user sessions, any visitor who can access the homepage can scrape a valid nonce and utilize it to authenticate their malicious requests.
This vulnerability directly maps to CWE-863, which addresses "Incorrect Authorization," as the system fails to properly verify that the entity making the password reset request has legitimate authorization to perform such an action. The flaw also aligns with ATT&CK technique T1566.002, which involves credential access through social engineering and exploitation of weak authentication mechanisms, specifically targeting the manipulation of password reset functionality within web applications. The implications for WordPress site security are severe, as successful exploitation enables attackers to completely compromise any account on the site, including high-privilege administrator accounts, leading to full site takeover and potential data breaches.
The recommended mitigation strategy involves immediate patching of the plugin to version 2.0.1 or later, which addresses this specific vulnerability by implementing proper authentication checks and removing the publicly exposed nonce mechanism. Administrators should also consider implementing additional security measures such as rate limiting for password reset requests, monitoring for unusual authentication patterns, and ensuring that all WordPress plugins are kept up-to-date with the latest security patches. Organizations should conduct thorough security audits of their WordPress installations to identify any other plugins or themes that might be vulnerable to similar authentication bypass techniques, while also implementing proper network-level protections such as web application firewalls to detect and prevent exploitation attempts.