Single Sign On For Tng
Monthly
Password reset abuse in the Single Sign On For TNG WordPress plugin (versions before 2.2.0) allows unauthenticated attackers to reset the password of any account, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password reset request, and publicly available exploit code exists, though EPSS scores the exploitation probability at a low 0.15% (4th percentile). It is not listed in CISA KEV, so exploitation is currently proof-of-concept rather than confirmed active in-the-wild use.
Password reset abuse in the Single Sign On For TNG WordPress plugin (versions before 2.2.0) allows unauthenticated attackers to reset the password of any account, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password reset request, and publicly available exploit code exists, though EPSS scores the exploitation probability at a low 0.15% (4th percentile). It is not listed in CISA KEV, so exploitation is currently proof-of-concept rather than confirmed active in-the-wild use.