CVE-2026-15964: WordPress SSO Plugin Critical Authentication Bypass

Executive Summary

A critical authentication bypass vulnerability has been disclosed in the Single Sign On For TNG WordPress plugin. Tracked as CVE-2026-15964 with a CVSS score of 9.8, the flaw allows any unauthenticated attacker to perform a password reset for any WordPress account — potentially leading to full site compromise.

CVSS Score: 9.8 (Critical)

Vulnerability Overview

Technical Details

Root Cause

The vulnerability exists in the ssoprocess_ajax() function within the plugin. This function is registered as a WordPress AJAX action handler via:

add_action('wp_ajax_nopriv_ssoprocess_ajax', 'ssoprocess_ajax');

The wp_ajax_nopriv_ prefix means the handler is reachable without any authentication — any visitor to the site can invoke it. The function handles Single Sign-On processing but performs insufficient validation before allowing a password reset operation, enabling an attacker to target any user account.

Attack Flow

1. Attacker identifies target WordPress site running Single Sign On For TNG <= 2.0.0
2. Crafts POST request to wp-admin/admin-ajax.php targeting ssoprocess_ajax
3. Submits password reset without authentication
4. Attacker gains control of targeted account (including administrator)
5. Full site compromise achieved

Why No Authentication?

WordPress AJAX handlers registered under wp_ajax_nopriv_ are intentionally designed to be accessible to logged-out users. When plugins register sensitive operations under this hook without implementing their own authentication checks, attackers can bypass the normal authentication layer entirely.

Affected Products

Remediation

Immediate Actions

1. Update the plugin to a version newer than 2.0.0 if a patch is available
2. Disable the plugin immediately if no patch is available
3. Audit administrator accounts for unexpected changes or new accounts
4. Review authentication logs for suspicious AJAX requests to ssoprocess_ajax
5. Reset credentials for any accounts that may have been compromised

Detection

Look for POST requests to wp-admin/admin-ajax.php with action=ssoprocess_ajax from unauthenticated sources in your web server logs. These requests should be treated as suspicious.

# Example log grep for suspicious AJAX calls
grep "ssoprocess_ajax" /var/log/nginx/access.log | grep -v "your-admin-ip"

Risk Assessment

Given the CVSS 9.8 score and the ease of exploitation — no authentication, no special knowledge, trivially accessible AJAX endpoint — this vulnerability poses a severe risk to any WordPress site running the affected plugin. Single Sign-On plugins are particularly high-value targets because they often hold credentials and session management for multiple integrated services.

References

• NVD — CVE-2026-15964
• WordPress Plugin Directory — Single Sign On For TNG

Related Reading

• CVE-2026-16144: Kali Forms WordPress Plugin Remote Code Execution
• BeyondTrust Remote Support Critical RCE Under Active Exploitation