WordPress security changelog
CRITICAL CVE-2026-15964 Received

Single Sign On For TNG lets visitors reset any account password

Single Sign On For TNG through 2.0.0 exposes ssoprocess_ajax() through wp_ajax_nopriv_ssoprocess_ajax. A visitor can scrape the shared logged-out ssoajaxnonce from SSOPWDREQUIREMENT on any front-end page, submit a target email with the setnewpassword operation, and make the handler call reset_password() without an ownership token, confirmation link or capability check, taking over any account including an Administrator.

CVE / CNA score 9.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Single Sign On For TNG
Plugin slug
single-sign-on-for-tng
Affected
<= 2.0.0
Safe version
> 2.0.0
Published
Aug 01, 2026
Weakness
CWE-620 — Unverified Password Change

This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.

What to do

Update, patch or deactivate.

Update to a corrected release after 2.0.0. Review password changes and logins, invalidate affected sessions, reset credentials through a trusted channel, and investigate Administrator activity.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources