A critical authentication bypass vulnerability in the Single Sign On For TNG plugin allows unauthenticated attackers to reset any user password and achieve full administrative site takeover.

The plugin fails to perform proper capability checks or ownership validation within the ssoprocess_ajax() function. Because the required security nonce is publicly exposed in client-side scripts, unauthenticated attackers can trivially bypass the intended authorization controls to reset passwords for any account.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of total system compromise. Successful exploitation grants an attacker administrative access to the WordPress environment, resulting in full control over sensitive data, unauthorized content modification, and the potential for persistent backdoors or malware distribution.

Immediate Action: Update the Single Sign On For TNG plugin to version 2.1.0 or later immediately.

Proactive Monitoring: Review WordPress user account logs for unexpected password changes or the creation of new administrator accounts.

Compensating Controls: If immediate patching is not possible, disable the plugin entirely until the update can be applied to prevent exploitation.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Given the ease of exploitation and the severity of impact, this vulnerability poses an immediate threat to any site running the affected plugin. Administrators must prioritize the update to version 2.1.0 to eliminate this critical risk.