What is GHSA-vqxg-c5fw-r4w9?

GHSA-vqxg-c5fw-r4w9 is a security advisory published by GitHub Security Advisories with Critical severity. The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password...

Which CVE IDs does GHSA-vqxg-c5fw-r4w9 cover?

GHSA-vqxg-c5fw-r4w9 covers the following CVE IDs: CVE-2026-16299. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vqxg-c5fw-r4w9?

GHSA-vqxg-c5fw-r4w9 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-vqxg-c5fw-r4w9CriticalCVSS 9.8

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password...

Vendor

GitHub Security Advisories

Published

August 10, 2026

Last Modified

August 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-16299 →

📋 Description

The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16299
https://wpscan.com/vulnerability/06532a5a-ad34-421e-81e3-b4e44e8023ab
https://github.com/advisories/GHSA-vqxg-c5fw-r4w9