Critical Auth Bypass Found in TNG Plugin

The Single Sign On For TNG plugin for WordPress contains a critical authentication bypass vulnerability, tracked as CVE-2026-15964. With a CVSS 3.1 score of 9.8, this flaw allows unauthenticated attackers to reset the passwords of any user on an affected site, including administrators, leading to full site takeover.

What's at Risk

This vulnerability affects all versions of the Single Sign On For TNG plugin up to and including version 2.0.0. Organizations running internet-facing WordPress deployments that utilize this specific plugin are at the highest risk of compromise.

Because the flaw resides in an AJAX handler, it does not require a valid user account or specific privileges to trigger. Any site using this plugin for SSO functionality is exposed to unauthorized account modifications, which can lead to data theft, defacement, or the installation of malicious software.

How the Flaw Works

Authentication bypass vulnerabilities of this nature typically occur when a software component fails to properly verify the identity of a request sender before performing sensitive operations. In many web applications, developers use nonces to ensure that requests are intentional and initiated by authorized users. However, if these nonces are exposed to the public or generated in a way that allows for easy prediction, they cease to function as an effective security barrier.

When an application relies on a publicly accessible token to authorize a password reset, it essentially removes the requirement for the attacker to prove ownership of the account. This allows an attacker to interact with the backend logic as if they were the legitimate user, bypassing the intended security flow entirely. This class of weakness highlights the danger of relying on client-side or easily observable data for server-side authorization checks.

How to Protect Your Systems

• Disable or remove the Single Sign On For TNG plugin immediately until a security update is released by the vendor.
• Audit user accounts for unauthorized changes, particularly checking for new administrator accounts created without your knowledge.
• Enforce Multi-Factor Authentication (MFA) across all WordPress administrative accounts to add a layer of defense against password-based attacks.
• Restrict access to the WordPress login and admin dashboard by IP address where possible to reduce the surface area for unauthenticated exploitation.
• Monitor server logs for suspicious requests targeting the wp_ajax_nopriv_ssoprocess_ajax endpoint.

Given the critical severity of CVE-2026-15964 and the ease with which it can be exploited, administrators should prioritize securing their installations immediately. The ability for an attacker to gain full control over a site without needing any credentials makes this a high-priority threat that demands prompt attention.