CVE-2026-15964

Name of the Vulnerable Software and Affected Versions Single Sign On For TNG versions prior to 2.0.1

Description An authentication bypass exists allowing unauthenticated password resets. The ssoprocess ajax() function, registered on wp ajax nopriv ssoprocess ajax, accepts an attacker-supplied email parameter during the setnewpassword operation and calls reset password() without requiring an ownership token, email confirmation, or capability check. The security check performed by check ajax referer() is ineffective because the ssoajaxnonce nonce is publicly exposed on front-end pages via wp localize script() within the SSOPWDREQUIREMENT JavaScript object. Because WordPress uses a shared anonymous session context for logged-out visitors, any unauthenticated user can obtain a valid nonce to authenticate the request, potentially allowing them to change the password of any account, including administrators, and take over the site.

Recommendations Update Single Sign On For TNG to a version newer than 2.0.0. As a temporary mitigation, restrict access to the wp ajax nopriv ssoprocess ajax endpoint.