WordPress SSO Plugin Unauthenticated Password Reset Flaw

The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it p

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Single Sign On For TNG WordPress plugin contains a critical authentication bypass vulnerability that allows attackers to reset user passwords without any verification or ownership confirmation. The vulnerability exists in the `ssoprocess_ajax()` function, which is explicitly registered to handle unauthenticated requests via `wp_ajax_nopriv_ssoprocess_ajax`. By sending a crafted request with an email address and the `setnewpassword` operation, an attacker can force a password reset on any user account without providing an ownership token or requiring email confirmation. This affects all versions up to 2.0.0 and is particularly dangerous because WordPress sites commonly use SSO plugins to manage authentication across multiple systems. Any organization running vulnerable versions of this plugin faces immediate risk of account takeover, unauthorized access, and potential lateral movement within their infrastructure.

Casky's 283 matching skills leverage Claude's extended reasoning to detect the attack patterns associated with MITRE techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious activity patterns such as: unauthenticated AJAX requests to the ssoprocess endpoint with setnewpassword operations, bulk email parameters being tested against the plugin, successful password resets without corresponding email confirmations in logs, and subsequent logins from unusual geographic locations or IP addresses immediately following reset requests. The skill set would correlate WordPress access logs showing wp_ajax_nopriv_ssoprocess_ajax calls with user account modification events and authentication changes, surfacing anomalies that indicate exploitation attempts or successful compromise before attackers can establish persistent access or escalate privileges within the organization.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15964.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-15964

Casky has 283 skills that investigate the attack patterns behind CVE-2026-15964. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn