The Single Sign On For TNG plugin for WordPress is vulnerable to an authentication bypass that allows any unauthenticated visitor to reset the password of any user account, including administrators. The flaw arises because the Ajax handler for password change is registered under wp_ajax_nopriv_ssoprocess_ajax and accepts a user‑supplied email together with a new password. It performs a reset_password() call without verifying ownership, capability, or proper confirmation links. As a result, an attacker can gain full control of the site by updating the administrator’s password.

WordPress sites that employ the britcoder Single Sign On For TNG plugin, specifically versions up to and including 2.0.0. Any installation using these versions exposes the vulnerable Ajax handler to the public web surface.

A CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by scraping the public nonce from any front‑end page, then issuing an unauthenticated POST to wp_ajax_nopriv_ssoprocess_ajax with the target email and new password. Because the nonce is shared across the anonymous session, any visitor can obtain a valid token and authenticate the request, leading to uncontrolled password changes.