Single Sign On For TNG WordPress Plugin Vulnerable to Authentication Bypass
The Single Sign On For TNG plugin for WordPress is reportedly vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This allows attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover.
What happened
The vulnerability, tracked as CVE-2026-15964 with a CVSS score of 9.8, is due to the `ssoprocess_ajax()` function accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard, a call to `check_ajax_referer()`, provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page.
To assess your exposure, check if your WordPress site is using the Single Sign On For TNG plugin version 2.0.0 or earlier. If so, it is recommended to upgrade to a version beyond 2.0.0 or apply a patch if available. The primary sources should be consulted for the most current information and recommended actions.
How 0Day mitigates this
sso_for_tng_plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.