CVE-2026-15964 is a critical vulnerability in the Single Sign On For TNG WordPress plugin affecting all versions up to and including 2.0.0. The vulnerability arises from the `ssoprocess_ajax()` function, which is registered as an unauthenticated AJAX handler (`wp_ajax_nopriv_ssoprocess_ajax`). This function accepts a `setnewpassword` operation with an attacker-supplied `email` parameter and calls `reset_password()` on the targeted account without any ownership verification, email confirmation, or capability checks. The only protection is a nonce check (`check_ajax_referer()`), but the nonce (`ssoajaxnonce`) is publicly exposed on all front-end pages via JavaScript, allowing any unauthenticated visitor to obtain a valid nonce and bypass authorization. This flaw allows attackers to change passwords of any WordPress user, including administrators, leading to full site compromise.

An unauthenticated attacker can reset the password of any WordPress account on a site using the vulnerable plugin, including administrator accounts. This enables complete site takeover, compromising confidentiality, integrity, and availability of the affected WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AJAX endpoint if possible or disable the Single Sign On For TNG plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.