What is the CVSS score of CVE-2026-16299?

CVE-2026-16299 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Single Sign On For TNG are affected by CVE-2026-16299?

The Single Sign On For TNG WordPress plugin (versions before 2.2.0) contains a critical password reset vulnerability enabling unauthenticated administrative account takeover.. A patch is available.

Is there a public PoC exploit available for CVE-2026-16299?

Yes, a public proof-of-concept exploit is available for CVE-2026-16299. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-16299?

Within 24 hours, identify all WordPress installations running Single Sign On For TNG plugin versions prior to 2.2.0. Within 7 days, update all affected installations to version 2.2.0 or later through the WordPress plugin management interface. Within 30 days, audit account activity and password reset logs for suspicious access, reset all administrator credentials as a precaution, and implement access controls restricting plugin updates to approved security personnel.

Single Sign On For TNG CVE-2026-16299

EUVD-2026-55035 CRITICAL

Improper Authentication (CWE-287)

2026-08-10 WPScan

GHSA-vqxg-c5fw-r4w9

WordPress Authentication Bypass Single Sign On For Tng Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote reset of arbitrary passwords with no user interaction gives AV:N/AC:L/PR:N/UI:N, and admin takeover yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:28 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

9.8 (CRITICAL)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

CRITICAL 9.8

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

AnalysisAI

Password reset abuse in the Single Sign On For TNG WordPress plugin (versions before 2.2.0) allows unauthenticated attackers to reset the password of any account, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password reset request, and publicly available exploit code exists, though EPSS scores the exploitation probability at a low 0.15% (4th percentile). It is not listed in CISA KEV, so exploitation is currently proof-of-concept rather than confirmed active in-the-wild use.

Technical ContextAI

The affected component is a WordPress authentication plugin, 'Single Sign On For TNG', which integrates The Next Generation of Genealogy Sitebuilding (TNG) accounts with WordPress user login. The vulnerability maps to CWE-287 (Improper Authentication): the plugin's password reset workflow fails to properly validate the reset request, meaning the token/ownership check that should bind a reset action to the legitimate account holder is missing or bypassable. Because WordPress plugins execute in the site's PHP context and can manipulate the wp_users table, a broken reset routine lets an attacker set arbitrary credentials. The CPE 'cpe:2.3:a:unknown:single_sign_on_for_tng:*' confirms all versions up to but excluding 2.2.0 are in scope, with the vendor field unresolved in the NVD/CPE dictionary.

RemediationAI

Upgrade the Single Sign On For TNG plugin to version 2.2.0 or later - a vendor-released patch is available and 2.2.0 is the first fixed release. Until the upgrade is applied, deactivate and remove the plugin, since the vulnerable password reset endpoint is exploitable without authentication and the plugin's core SSO function cannot be safely retained while unpatched; if SSO cannot be disabled, restrict access to WordPress password reset and login endpoints (wp-login.php actions) at the WAF/reverse-proxy layer to trusted IPs, accepting that this also limits legitimate remote resets. After patching, audit administrator and user accounts for unexpected password changes and force a global password reset and session invalidation. Reference the WPScan advisory at https://wpscan.com/vulnerability/06532a5a-ad34-421e-81e3-b4e44e8023ab/.