CVE Catalog
CVE-2026-16299
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.15%
4th percentile - higher than 4% of all known CVEs
Summary
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
Risk Assessment
Risk of full WordPress site takeover, loss of control over content and user data.
Recommendation
Update the Single Sign On For TNG plugin to version 2.2.0 or later.
Original NVD description (English source)
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.