Junglewise Threat Intelligence

CVE-2026-15964: britcoder Single Sign On For TNG authentication bypass via password reset

CVE-2026-15964 · Severity: critical · CVSS 9.8 · Published 2026-08-01

Executive brief

The Single Sign On For TNG plugin for WordPress, which integrates WordPress with The Next Generation of Genealogy Sitebuilding software, contains a critical security flaw that allows anyone to reset user passwords. An attacker can exploit this to change the password of any account, including administrators, without needing any existing login credentials or special access. This could lead to a complete takeover of the website, resulting in data theft, site defacement, or total loss of control over the platform.

Technical details

The Single Sign On For TNG plugin for WordPress is vulnerable to an authentication bypass due to an insecure implementation of the `ssoprocess_ajax()` function. This function is registered via `wp_ajax_nopriv_ssoprocess_ajax`, making it accessible to unauthenticated users. When the `setnewpassword` operation is requested, the plugin calls `reset_password()` on a user account identified by an attacker-supplied email address without requiring an ownership token or email confirmation. While the plugin uses `check_ajax_referer()` for protection, the required nonce (`ssoajaxnonce`) is publicly exposed on the front-end via `wp_localize_script()`. Because WordPress nonces for unauthenticated sessions are shared, any visitor can retrieve a valid nonce and successfully trigger the password reset for any account, including administrators.

Affected products

  • britcoder Single Sign On For TNG up to, and including, 2.0.0

Timeline

  • 2026-08-01: disclosed
  • 2026-08-01: advisory

References