CVE-2026-16299: TNG WordPress Authentication Bypass Flaw

CVE-2026-16299 Overview

CVE-2026-16299 is a critical authentication bypass vulnerability in the Single Sign On For TNG WordPress plugin versions prior to 2.2.0. The plugin fails to properly validate password reset requests, allowing unauthenticated attackers to reset the password of any user account, including administrators. Successful exploitation grants attackers full administrative control over the affected WordPress site. The flaw is classified under CWE-287: Improper Authentication and is exploitable remotely over the network without user interaction.

Critical Impact
Unauthenticated remote attackers can reset arbitrary administrator passwords, leading to complete site takeover.

Affected Products

Single Sign On For TNG WordPress plugin versions before 2.2.0
WordPress sites using the vulnerable plugin for TNG integration
Any deployment exposing the plugin's password reset endpoint to the internet

Discovery Timeline

2026-08-10 - CVE-2026-16299 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-16299

Vulnerability Analysis

The Single Sign On For TNG plugin integrates WordPress user authentication with The Next Generation (TNG) genealogy software. The plugin exposes a password reset workflow that fails to verify whether the requester is authorized to reset the target account's password. An attacker can submit a crafted request naming any username, including admin, and the plugin will process the reset without validating ownership or requiring a valid reset token.

Because the vulnerability requires no authentication, no user interaction, and can be triggered over the network, any internet-facing site running the affected plugin is exposed. Attackers who successfully reset an administrator password inherit the ability to install malicious plugins, modify site content, exfiltrate user data, and pivot to the underlying host.

Root Cause

The root cause is missing authorization and token validation in the password reset handler. Proper WordPress password reset flows generate a one-time cryptographic key stored against the user record and verify it before applying a new password. The affected plugin bypasses this control, treating the reset request as trusted based solely on the supplied username.

Attack Vector

An unauthenticated attacker sends an HTTP request to the plugin's password reset endpoint, specifying a target username and a new password. The plugin writes the new password to the WordPress user table without token verification. The attacker then authenticates as the compromised user through the standard WordPress login page. Full technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16299

Indicators of Compromise

Unexpected password changes for administrator accounts recorded in WordPress user metadata
HTTP POST requests to the Single Sign On For TNG plugin's reset endpoint from unfamiliar IP addresses
New administrator sessions originating from geolocations inconsistent with legitimate site operators
Installation of unknown plugins, themes, or PHP files shortly after a password reset event

Detection Strategies

Monitor WordPress wp_users and wp_usermeta tables for password hash changes not preceded by a legitimate reset email
Inspect web server access logs for requests targeting the plugin's reset handler with high-value usernames
Correlate authentication events with prior password reset activity to identify anomalous sequences

Monitoring Recommendations

Enable WordPress audit logging plugins that capture user profile modifications and login events
Forward WordPress and web server logs to a centralized SIEM for correlation and retention
Alert on any administrator password change combined with a login from a new IP within a short time window

How to Mitigate CVE-2026-16299

Immediate Actions Required

Upgrade the Single Sign On For TNG plugin to version 2.2.0 or later without delay
Force a password reset for all administrator and privileged accounts on affected sites
Review installed plugins, themes, and administrator accounts for unauthorized additions
Rotate WordPress secret keys and salts in wp-config.php to invalidate existing sessions

Patch Information

The vendor addressed the vulnerability in version 2.2.0 of the Single Sign On For TNG plugin. Site operators should update through the WordPress plugin dashboard or replace the plugin files manually. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the Single Sign On For TNG plugin until the patched version can be deployed
Restrict access to WordPress administrative and plugin endpoints using a web application firewall
Block requests to the plugin's password reset endpoint at the reverse proxy or WAF layer

bash

# Example WAF rule to block requests to the vulnerable reset endpoint
# Adjust the path and parameter names to match your deployment
SecRule REQUEST_URI "@contains sso-for-tng" \
  "id:1026162990,phase:1,deny,status:403,\
  msg:'Block CVE-2026-16299 password reset attempts'"