Executive brief
The Single Sign On For TNG WordPress plugin allows attackers without an account to reset the passwords of any user, including administrators, without proper validation. An attacker can exploit this by making a simple web request to change an admin's password and gain full control of the WordPress site, leading to complete site takeover and potential data theft or malware installation.
Technical details
The plugin's password reset functionality in the ssoprocess_ajax AJAX action fails to properly validate reset requests, allowing unauthenticated attackers to reset passwords for arbitrary users. The vulnerability is in the password reset logic, which accepts a user email, new password, and a timeout parameter without sufficient validation. An attacker can scrape the public AJAX nonce from any page and submit a crafted request to the wp-admin/admin-ajax.php endpoint with action=ssoprocess_ajax and operation=setnewpassword to change any user's password. The only validation added in version 2.1.0 was an expiry check against an attacker-supplied timestamp, which can be bypassed by providing a far-future value. The vulnerability requires the plugin to be configured with TNG database access (its normal operating state) and network access to the WordPress installation.
Affected products
- Single Sign On For TNG Single Sign On For TNG before 2.2.0
Timeline
- 2026-08-05: disclosed
- 2026-08-10: patched: Fixed in version 2.2.0
- 2026-08-10: advisory: CVE-2026-16299 published