THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-15964 (CRITICAL 9.8) — The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore re

[NVD] CVE-2026-15964 (CRITICAL 9.8) — The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore re

mednvdPublished 2026-08-01

CVE-2026-15964 CVSS: 9.8 CRITICAL Published: 2026-08-01T09:17:00.137

The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an atta

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-15964cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-15964