Description
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Single Sign On For TNG | < 2.2.0 | 2.2.0 |
References
- https://wpscan.com/vulnerability/06532a5a-ad34-421e-81e3-b4e44e8023ab/ exploit vdb-entry technical-description