CVE-2026-16299

This is a password reset bypass in a WordPress SSO plugin (versions before 2.2.0) that allows unauthenticated attackers to reset arbitrary user passwords, including administrators. The CVSS 9.8 is warranted here — full site takeover is not marketing when a single password reset collapses the entire trust model. The root cause isn't simply missing validation — it's what happens when an SSO plugin implicitly takes ownership of authentication lifecycle edges that WordPress core handles correctly in isolation. Password reset is a state transition where delegated identity (the SSO assertion) meets traditional credential operations (the reset token). When the plugin shadows WordPress's native auth, it creates a logic path where the reset token validation can be bypassed under specific SSO conditions — typically because the plugin reasoned that 'SSO users shouldn't need traditional credential flows' without sufficient guards to prevent that bypass from being reached by unauthenticated attackers. This failure mode is not a one-off. CVE-2018-9038 in a SAML library, CVE-2021-39199 in an OAuth implementation, CVE-2023-28321 in an OIDC provider — all share the same genealogical signature: a delegation layer that assumes ownership of the full auth lifecycle, then fumbles the state transition where delegated identity meets traditional credential operations. The conditional will likely treat SSO session state as sufficient for a flow that requires fresh token verification. What should you do? First, audit any SSO or authentication-shadowing plugins on your WordPress sites for password reset, account recovery, or credential change flows. These are the collision points. Second, check whether your SSO plugin is actually updating — SSO plugins often don't surface in standard WordPress update workflows the way core does, creating a remediation gap between CVE publication and actual patching. Third, map your blast radius: an admin account compromised through this bypass doesn't just give you one account — it gives you an account trusted by every plugin that checks `is_user_logged_in()` without additional verification, every integration that trusts the WordPress session as a proxy for authorization. The compounding risk isn't just the vulnerability existing. It's that attackers now have the roadmap — the CVE, the version numbers, the failure mode — while defenders may not even know they're running a vulnerable version. Prioritize patching SSO plugins with the same urgency you reserve for WordPress core.

Reviewed through automated stages and approved by a human before publication.