AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-16299

CRITICAL · CVSS 9.8 EPSS 0.34%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The Single Sign On For TNG WordPress plugin prior to version 2.2.0 is vulnerable due to inadequate validation of password reset requests, enabling unauthenticated attackers to reset passwords for any user, including administrators. This flaw poses a significant risk of full site takeover, making it critical for WordPress site administrators using this plugin to prioritize immediate updates to mitigate potential exploitation.

CVE
CVE-2026-16299
Severity
CRITICAL
CVSS
9.8
EPSS
0.34%
WordPress

Original NVD Description

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.