PT-2026-67087 · WordPress · Single Sign On For Tng
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Single Sign On For TNG versions prior to 2.0.1
Description
An authentication bypass exists allowing unauthenticated password resets. The
ssoprocess ajax() function, registered on wp ajax nopriv ssoprocess ajax, accepts an attacker-supplied email parameter during the setnewpassword operation and calls reset password() without requiring an ownership token, email confirmation, or capability check. The security check performed by check ajax referer() is ineffective because the ssoajaxnonce nonce is publicly exposed on front-end pages via wp localize script() within the SSOPWDREQUIREMENT JavaScript object. Because WordPress uses a shared anonymous session context for logged-out visitors, any unauthenticated user can obtain a valid nonce to authenticate the request, potentially allowing them to change the password of any account, including administrators, and take over the site.Recommendations
Update Single Sign On For TNG to a version newer than 2.0.0.
As a temporary mitigation, restrict access to the
wp ajax nopriv ssoprocess ajax endpoint.Fix
LPE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Single Sign On For Tng