WordPress Single Sign On For TNG Plugin Authentication Bypass (Unauthenticated Password Reset)

Technical Analysis

The vulnerability resides in the ssoprocess_ajax() function, registered via wp_ajax_nopriv_ssoprocess_ajax and thus reachable by unauthenticated visitors, which processes a 'setnewpassword' operation by calling reset_password() on an attacker-supplied email parameter without verifying account ownership, a confirmation token, or capability checks. The only protective control is check_ajax_referer(), but the nonce (ssoajaxnonce) is embedded in every front-end page via wp_localize_script() into the SSOPWDREQUIREMENT JS object, and since WordPress computes this nonce against a shared anonymous session context for logged-out users, any visitor can scrape a valid nonce and forge a legitimate request. This constitutes a broken access control / CWE-620 (Unverified Password Change) flaw enabling full admin account takeover via a simple scripted HTTP request. If exploited on hosting infrastructure or CMS instances used to power AI agent-facing websites, chatbots, or RAG content pipelines, attackers gaining admin access could inject malicious content, exfiltrate API keys/secrets stored in the WordPress environment, or pivot to backend systems that agents ingest data from, indirectly poisoning agent knowledge sources.

Affected Systems

WordPress sites running the 'Single Sign On For TNG' plugin, versions up to and including 2.0.0

Indicators of Compromise

• N/A - vulnerability disclosure; no known IOCs published at this time (monitor for POST requests to wp-admin/admin-ajax.php with action=ssoprocess_ajax and op=setnewpassword)

Remediation Steps

1. 1

   Update the plugin

   Upgrade Single Sign On For TNG to a patched version beyond 2.0.0 as soon as it becomes available from the vendor.

2. 2

   Disable or remove the plugin

   If no patch is available, disable or uninstall the plugin until a fix is released.

3. 3

   Monitor AJAX endpoints

   Review server logs for suspicious admin-ajax.php requests referencing 'ssoprocess_ajax' or 'setnewpassword' operations.

4. 4

   Force password resets

   If compromise is suspected, force reset all administrator and privileged account passwords and invalidate active sessions.

5. 5

   Enable WAF rules

   Deploy a web application firewall rule to block unauthenticated calls to the vulnerable AJAX action until patched.

6. 6

   Audit for unauthorized admin accounts

   Check for newly created or modified administrator accounts and unexpected plugin/theme changes indicating takeover.