External risk intelligence

WordPress Single Sign On Plugin Authentication Bypass Allows Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15964

This vulnerability exists in a WordPress plugin that exposes functionality on the public-facing front-end. The affected AJAX action is registered as public (nopriv), making it reachable by any unauthenticated visitor to the website. Because it targets the standard web interface of a CMS, it is commonly exposed to the internet in typical deployments.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Single Sign On For TNG WordPress plugin allows unauthenticated attackers to reset any user's password, potentially leading to complete website takeover. This issue stems from a flaw in how the plugin verifies user account ownership during the password reset process.

Plugin allows password changes without proof of ownership.
Affects website control and user data integrity.
Confirm plugin relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by exploiting a password reset flaw in the Single Sign On For TNG WordPress plugin. By sending a specially crafted request to the plugin's AJAX function, an attacker can trick the system into resetting any user's password without needing to know the current password or possess any special privileges. This could allow them to take full control of the WordPress site.

Accessible via public website interface.
Unauthenticated password reset request.
Complete site takeover risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to reset the password for any user account, including administrative accounts, on a WordPress site. This is possible because the plugin fails to properly validate the request, allowing attackers to bypass security checks and gain control of the website.

WordPress user accounts.
Via unauthenticated password reset.
Complete site takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Attackers can take over any WordPress site by exploiting an authentication bypass in the Single Sign On For TNG plugin. This vulnerability allows unauthenticated users to reset any account's password without proper authorization checks. The first practical move is to identify all WordPress sites using this plugin, determine their exposure and criticality, identify the accountable owner, and then plan remediation.

WordPress administrators should own this issue.
Verify plugin usage and network exposure.
Plan vendor coordination or disable plugin.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Single Sign On For TNG plugin?

It is an add-on for WordPress websites designed to streamline how users log in by integrating external identity services. By simplifying authentication, it allows users to access the site using credentials managed elsewhere. The plugin operates by communicating with these services, but as seen in CVE-2026-15964, it also includes internal functions for handling password-related tasks directly within the WordPress environment.

What does this authentication bypass actually mean?

This vulnerability is classified as CWE-620, which relates to a failure to verify the identity of the person making a request. In this case, the plugin allows anyone to trigger a password reset for any account, including administrators. Because the system performs this reset without checking for ownership proof like an email link or a secret token, an attacker can effectively seize control of any user account by simply requesting a new password.

How do attackers trigger this password reset flaw?

An attacker targets a specific AJAX function within the plugin that was intended to be public but lacks robust security. They obtain a required nonce—a short-term security token—which the plugin mistakenly exposes to everyone on the site's front-end code. With this token in hand, the attacker sends a request to the server that masquerades as a legitimate password reset, bypassing all authentication requirements. Simply visiting the site as a guest does not trigger the bug.

Is my WordPress site at risk from this?

If you use this plugin, your site is likely at risk. According to Halo Surface Signal, this vulnerability is highly relevant because the flaw is reachable via the public-facing side of your website. Since the affected code is designed to be accessible to visitors, any site using this plugin that is exposed to the internet provides a clear path for an unauthorized user to attempt a password reset.

What should I do if I run this software?

First, confirm whether your WordPress installation is currently using the Single Sign On For TNG plugin. If it is active, assess how critical the affected site is to your operations and identify who is responsible for managing it. Given the severity of the potential for site takeover, you should coordinate with your team to disable the plugin immediately until you can verify if a secure version or alternative solution is available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.