CVE-2026-16299 — Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Reset
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitra…
Published: 2026-08-10 · CVSS: 9.8 · CVSS 3.1
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7