9.8
Critical
CVE-2026-16299 The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing…
Description
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Single Sign On For TNG 2.2 | earliest → < 2.2.0 | 2.2.0 |