CVE-2026-15964
Received Received - Intake

Authentication Bypass via Password Reset in Single Sign On For TNG WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-15964
EUVD
EUVD-2026-51789

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordfence sso_for_tng to 2.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in the Single Sign On For TNG WordPress plugin. It allows unauthenticated attackers to reset any user's password, including administrators, by exploiting a flawed password reset process. The issue stems from the plugin's AJAX function accepting an email parameter without proper checks, enabling full site takeover.

Detection Guidance

This vulnerability can be detected by checking if the Single Sign On For TNG plugin is installed and active on your WordPress site. Inspect the plugin version and look for unauthenticated password reset attempts in server logs. No specific commands are provided in the context.

Impact Analysis

If you use this plugin, attackers could take over your WordPress site by resetting admin passwords. This grants full control over your website, including content, user data, and settings. The vulnerability is remotely exploitable without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. A breach may result in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately update the Single Sign On For TNG plugin to the latest version beyond 2.0.0. If an update is unavailable, consider disabling or removing the plugin until a patch is released. Review server logs for unauthorized password reset attempts and reset passwords for all accounts if suspicious activity is detected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15964. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart