CVE-2026-15964: CWE-620 Unverified Password Change in britcoder Single Sign On For TNG
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover.
AI Analysis
Technical Summary
CVE-2026-15964 is an authentication bypass vulnerability in the Single Sign On For TNG plugin for WordPress, affecting all versions up to and including 2.0.0. The vulnerability arises because the ssoprocess_ajax() function, exposed via the wp_ajax_nopriv_ssoprocess_ajax hook, allows unauthenticated password resets by accepting an attacker-supplied email parameter with the setnewpassword operation. The function calls reset_password() without verifying ownership tokens, email confirmation links, or user capabilities. The only protection is a nonce check via check_ajax_referer(), but the nonce (ssoajaxnonce) is publicly available on all front-end pages and can be scraped by unauthenticated visitors, making the nonce ineffective as an authorization barrier. This enables attackers to change passwords of any WordPress account, including administrators, leading to full site compromise.
Potential Impact
Successful exploitation allows unauthenticated attackers to reset passwords of any WordPress user, including administrators. This results in complete site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable plugin or disable it to prevent exploitation. Monitor official britcoder communications for updates and apply patches promptly once released.
CVE-2026-15964: CWE-620 Unverified Password Change in britcoder Single Sign On For TNG
Description
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover.
CVSS v3.1
Score 9.8critical
Affected software
britcoder
Single Sign On For TNG
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15964 is an authentication bypass vulnerability in the Single Sign On For TNG plugin for WordPress, affecting all versions up to and including 2.0.0. The vulnerability arises because the ssoprocess_ajax() function, exposed via the wp_ajax_nopriv_ssoprocess_ajax hook, allows unauthenticated password resets by accepting an attacker-supplied email parameter with the setnewpassword operation. The function calls reset_password() without verifying ownership tokens, email confirmation links, or user capabilities. The only protection is a nonce check via check_ajax_referer(), but the nonce (ssoajaxnonce) is publicly available on all front-end pages and can be scraped by unauthenticated visitors, making the nonce ineffective as an authorization barrier. This enables attackers to change passwords of any WordPress account, including administrators, leading to full site compromise.
Potential Impact
Successful exploitation allows unauthenticated attackers to reset passwords of any WordPress user, including administrators. This results in complete site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable plugin or disable it to prevent exploitation. Monitor official britcoder communications for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-16T15:00:32.244Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6dba19bf32cb7a347ed904
Added to database: 08/01/2026, 09:19:21 UTC
Last enriched: 08/08/2026, 14:23:33 UTC
Last updated: 09/15/2026, 22:01:32 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.