SYS::ONLINE
Wasteland.
Briefs1653
Issues21
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-15964 2026-08-01

CVE-2026-15964: Unauthenticated Password Reset in Single Sign On For TNG Could Enable WordPress Site Takeover

"A critical authentication bypass reported in the Single Sign On For TNG WordPress plugin (all versions through 2.0.0) is described as allowing an unauthenticated visitor to reset the password of any account, including…"

A critical authentication bypass reported in the Single Sign On For TNG WordPress plugin (all versions through 2.0.0) is described as allowing an unauthenticated visitor to reset the password of any account, including administrators. The vulnerable code path is confirmed in the plugin source; the end-to-end exploitation chain is inferred from that source and from the assigned CVSS vector rather than from any published proof-of-concept.

What Is It

The plugin registers ssoprocess_ajax() on the wp_ajax_nopriv_ssoprocess_ajax hook, making it reachable without authentication. When called with the setnewpassword operation, the function accepts an attacker-supplied email parameter and calls reset_password() on the resolved account; with no ownership token, no email confirmation link, and no capability check.

The only guard is check_ajax_referer(). Based on the plugin source, the ssoajaxnonce nonce appears to be passed to the front end via wp_localize_script() inside the SSOPWDREQUIREMENT JavaScript object, which would place it in the page markup delivered to unauthenticated visitors; WordPress computes nonces for logged-out visitors against a shared anonymous session context, so a nonce issued to one anonymous visitor would be expected to validate for another. On that reading, an attacker could scrape a valid nonce from a front-end page and replay it against the AJAX endpoint. No public proof-of-concept demonstrating this chain has been published at the time of writing.

The flaw is tracked as CWE-620 (Unverified Password Change), reported by Wordfence, and published 2026-08-01.

Why It Matters

CVSS 3.1 base score is 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Network attack vector, low complexity, no privileges, no user interaction, and high impact across confidentiality, integrity, and availability.

The outcome implied by that rating is complete site takeover: an attacker who knows or guesses an administrator's email address would be able to seize the account outright. Consistent with the vector's low attack complexity and no-privileges rating, the exploitation path would require little more than fetching a page and issuing a single AJAX request, though this has not been confirmed against a live installation by any published exploit.

CVE-2026-15964 does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing, so there is no confirmed active exploitation or federal remediation deadline on record.

What's Vulnerable

No CPE entries were published with the record.

Patch Status

NVD lists the CVE as Received: the record is still awaiting full analysis. The references include a WordPress plugin repository changeset (3624827@single-sign-on-for-tng) associated with the fix. Neither the NVD record nor the Wordfence advisory states a fixed version number. Operators running 2.0.0 or earlier should verify the installed version against the plugin repository and update or remove the plugin.

Sources