Password Reset Vulnerability in Single Sign On For TNG WordPress Plugin
CVE-2026-16299
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16299?
The Single Sign On For TNG WordPress plugin prior to version 2.2.0 has a vulnerability that fails to properly validate password reset requests. This flaw allows an unauthenticated attacker to reset passwords of any user, including administrators, potentially enabling a full site takeover. Administrators should ensure they are using the latest version of the plugin to mitigate this risk.
Affected Version(s)
Single Sign On For TNG 0 < 2.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.