critical9.8
CVE-2026-16299
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the p…
Impact
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
Affected products
| Product | Affected versions |
|---|---|
| Single Sign On For TNG WordPress Plugin | before 2.2.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.