Skip to content
eastbaycyber

CVE-2026-15964: Unauthenticated Password Reset in Single Sign On For TNG

CVE explainers 10 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-08-01
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - Critical WordPress plugin flaw allows unauthenticated password resets. - Sites running Single Sign On For TNG up to 2.0.0 are affected. - Patch version is not confirmed, so disable or remove the plugin if no verified fix is available.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-15964
CVSS score 9.8 Critical
Attack vector Network
Privileges required None
Patch available Not confirmed from accessible primary patch notes

CVE-2026-15964 affects the Single Sign On For TNG WordPress plugin and is described by NVD as an authentication bypass via unauthenticated password reset. The practical impact is severe: an attacker can reset the password for an arbitrary WordPress user, including an administrator, and then log in with the attacker-chosen password.

The key operational point for defenders is that this is not a low-impact bug requiring unusual preconditions. The issue is reachable over the web, does not require prior authentication, and targets one of the most sensitive workflows in WordPress: account password management. Even though a fixed version could not be confirmed from the retrieved source material, all versions up to and including 2.0.0 should be treated as vulnerable.

What Is This Vulnerability?

According to the NVD description, the vulnerability exists in the plugin’s AJAX handler, specifically the ssoprocess_ajax() function exposed through wp_ajax_nopriv_ssoprocess_ajax. In WordPress, the nopriv AJAX hook means the endpoint is intended to be callable by unauthenticated visitors. That is not inherently unsafe, but it becomes critical when the function behind it performs privileged account actions without a real ownership or authorization check.

In this case, the vulnerable logic accepts an attacker-controlled email parameter, processes the setnewpassword operation, and calls reset_password() on the resolved WordPress account. NVD states that this flow lacks a valid ownership token, email confirmation mechanism, or capability check. As a result, the endpoint can be abused to set a new password for a chosen victim account rather than merely initiating a normal password recovery workflow.

Technical Notes

The security control that should have stopped this was a nonce validation via check_ajax_referer(). However, NVD explicitly notes that the nonce value, ssoajaxnonce, is made public on front-end pages through wp_localize_script() into the SSOPWDREQUIREMENT JavaScript object. For logged-out users, WordPress nonces are not an authorization boundary in this scenario because anonymous visitors can obtain a valid nonce directly from the public site.

A simplified representation of the risky pattern described by NVD looks like this:

add_action('wp_ajax_nopriv_ssoprocess_ajax', 'ssoprocess_ajax');

function ssoprocess_ajax() {
    check_ajax_referer('ssoajaxnonce', 'nonce');

    $operation = $_POST['operation'] ?? '';
    $email = $_POST['email'] ?? '';
    $new_password = $_POST['newpassword'] ?? '';

    if ($operation === 'setnewpassword') {
        $user = get_user_by('email', $email);
        if ($user) {
            reset_password($user, $new_password);
        }
    }
}

The problem is not just exposure of an AJAX endpoint. The problem is using a public nonce as if it proves user identity, then allowing a password reset for an arbitrary account.

AnalystImpact · assess the risk

Who Is Affected?

The affected product is the Single Sign On For TNG plugin for WordPress. Based on the NVD record, all versions up to and including 2.0.0 are vulnerable. That wording is important because it establishes both the upper bound of known vulnerable versions and the fact that defenders cannot safely assume earlier 2.x releases are unaffected.

At the time of writing, the fixed version number is not confirmed from the source material available in this research context. The WordPress Trac references cited by NVD were not directly retrievable here due to access restrictions, and no accessible vendor advisory or patch note was available to verify the exact release containing a fix. In practice, defenders should assume that any environment running version 2.0.0 or earlier remains exposed unless they can independently verify a later patched release from the official WordPress plugin page or trusted maintainer documentation.

For administrators managing multiple WordPress sites, this matters because plugin sprawl is common. A site owner may not immediately recognize that a genealogy-related SSO plugin is present on production, staging, or legacy sites. Inventory should include all WordPress instances, not just primary customer-facing systems.

For managed hosting providers and MSPs, this vulnerability is especially relevant in shared operational environments. A single overlooked vulnerable site can provide an attacker with a straightforward route to administrative access, followed by malicious plugin uploads, web shell placement, user creation, or content tampering.

CVSS Score Breakdown

NVD assigns CVSS 9.8 Critical, which is consistent with the reported impact. Although the specific vector string was not returned in the provided tool output, the score strongly suggests the vulnerability is considered remotely exploitable, requires no privileges, and has high impact on confidentiality, integrity, and availability.

A score this high makes sense for several reasons. First, the attack is performed over the network through a web-accessible endpoint. Second, no authentication is required because the vulnerable handler is registered under a nopriv AJAX action. Third, once an attacker resets an administrator password, the rest of the compromise chain is routine: log in, install a malicious plugin, edit theme files, create backdoor accounts, or modify content and payment workflows.

In practical terms, CVSS 9.8 tells defenders this is not just a bug that crashes a component or leaks a minor detail. It is an account takeover issue with a plausible path to full WordPress site compromise. Even if no active exploitation has been publicly confirmed yet, the bug characteristics justify urgent response.

The missing vector string is worth noting. When exact vector details are unavailable from your source, do not fill in the blanks from assumption alone. What defenders should assume here is simple: the severity is already high enough to prioritize immediate containment without waiting for a richer CVSS breakdown.

Exploitation Status

As of the available research, active exploitation in the wild is not confirmed. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at this time. That does not mean the bug is safe to defer. It means there is no public CISA-backed confirmation of broad real-world exploitation from the sources reviewed here.

A public proof of concept is also not confirmed from the retrieved material. However, defenders should not take comfort in the absence of a clearly indexed GitHub repository. The NVD description provides enough detail to reproduce the flaw: fetch a public nonce from the front end, call the unauthenticated AJAX endpoint, supply a target email, and invoke the password reset logic. That lowers the barrier to weaponization significantly.

Technical Notes

From an attacker workflow perspective, the exploitation chain described by NVD would likely resemble:

  1. Request a public page on the target WordPress site.
  2. Extract the localized JavaScript object containing ssoajaxnonce.
  3. Submit a POST request to admin-ajax.php.
  4. Set the operation to setnewpassword.
  5. Provide the victim’s email address and attacker-controlled password.

A generic HTTP shape defenders should look for is:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim.example
Content-Type: application/x-www-form-urlencoded

action=ssoprocess_ajax&operation=setnewpassword&email=admin@example.com&newpassword=NewPass123!&nonce=<public_nonce>

Parameter names can vary in practice depending on implementation details, so treat this as a hunting pattern, not a guaranteed exact signature.

ResponderRunbook · act now

How to Detect It

Detection should focus on two areas: suspicious requests to the vulnerable AJAX action and signs of account takeover immediately afterward. Since the issue enables unauthorized password changes, defenders should correlate web requests to admin-ajax.php with subsequent successful logins for high-value accounts, especially administrator accounts, from unusual IPs, ASNs, or geographies.

If you have web server logs, look for POST requests to /wp-admin/admin-ajax.php containing the action associated with the plugin. Given the NVD description, ssoprocess_ajax and the setnewpassword operation are the most useful anchors. On compromised sites, password reset abuse may be followed by admin dashboard access, plugin installation, theme editor usage, or creation of new users with administrative roles.

Technical Notes

Example grep-based hunting against Apache or Nginx access logs:

grep -Ei 'POST .*wp-admin/admin-ajax\.php' /var/log/nginx/access.log | grep -Ei 'ssoprocess_ajax|setnewpassword'

If your logging includes request bodies in a WAF, reverse proxy, or EDR telemetry, look for patterns such as:

action=ssoprocess_ajax
operation=setnewpassword
email=
newpassword=

A simple Sigma-style conceptual rule for log pipelines that capture URL and body fields:

title: WordPress Single Sign On For TNG suspicious password reset attempt
logsource:
  category: webserver
detection:
  selection_url:
    cs-uri-stem: "/wp-admin/admin-ajax.php"
  selection_body_1:
    request_body|contains: "action=ssoprocess_ajax"
  selection_body_2:
    request_body|contains: "setnewpassword"
  condition: selection_url and selection_body_1 and selection_body_2
level: high

Also review WordPress authentication events for: - successful logins by admin users shortly after matching AJAX requests - password change events that lack corresponding user-initiated recovery workflows - new plugin or theme modifications after suspicious admin logins

If you do not have request-body visibility, assume detection fidelity is reduced and prioritize containment plus credential rotation for privileged users.

Mitigation and Patching

The most important limitation in current public data is that the specific fixed version is not confirmed from the sources provided. What is confirmed is that all versions up to and including 2.0.0 are vulnerable. If the official WordPress plugin page now offers a newer version, administrators should verify from release notes or maintainer documentation that it explicitly addresses CVE-2026-15964 before relying on it as remediation.

If no verified patched version is available, the safest course is to disable and remove the plugin. Because the issue enables full account takeover, temporary compensating controls alone are weaker than removal. If business requirements make immediate removal difficult, restrict access to WordPress admin paths, place the site behind a WAF with body inspection for the vulnerable action, and monitor all privileged account activity closely. These are stopgaps, not substitutes for a real fix.

After mitigation, assume credentials may already have been compromised. Reset passwords for all administrator accounts, review for unauthorized users, inspect plugin and theme files for modifications, and check for persistence mechanisms such as cron jobs, rogue plugins, or injected PHP in writable directories.

Technical Notes

If a verified fixed version becomes available through WordPress CLI, the upgrade workflow would typically be:

wp plugin list | grep single-sign-on-for-tng
wp plugin update single-sign-on-for-tng

If no verified fix exists, disable and remove the plugin:

wp plugin deactivate single-sign-on-for-tng
wp plugin uninstall single-sign-on-for-tng

You should then rotate privileged credentials and inspect for compromise:

wp user list --role=administrator
wp plugin list
wp theme list

A defensive WAF-style pattern to block obvious exploit attempts while you work remediation could match:

POST /wp-admin/admin-ajax.php
AND request body contains "action=ssoprocess_ajax"
AND request body contains "setnewpassword"

Use this only as a temporary reduction measure. Attackers may vary parameter order or encoding, and WAF coverage is not the same as removing the vulnerable code path.

References

Primary technical details for CVE-2026-15964 come from the NVD entry, which describes the vulnerable function, the unauthenticated AJAX registration, the exposed nonce, and the password reset path. That record is the basis for the vulnerability description, affected version range, and severity used in this article.

The plugin identity and distribution channel are verified through the official WordPress.org plugin listing for Single Sign On For TNG. CISA KEV status was checked and, at the time of this writing, the CVE is not listed there. Because the referenced WordPress Trac links were not directly accessible in this research environment, the exact fixed version and patch diff could not be independently confirmed. Defenders should continue to monitor the official plugin page and NVD for updated remediation details.

When key remediation data is missing, the operational default should be conservative: treat internet-exposed WordPress sites with this plugin installed as high risk, remove the vulnerable component if no verified fix is available, and perform post-exposure account and integrity review.

For more information on securing your WordPress site, check out our articles on how attackers use mailbox rules to hide email fraud and CVE-2026-14459.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-08-01

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.