The Single Sign On For TNG plugin for WordPress (versions up to and including 2.0.0) contains a critical authentication bypass vulnerability via unauthenticated password reset. The vulnerable ssoprocess_ajax() function is registered on the nopriv AJAX hook, making it accessible without authentication. An attacker can supply any email address with the setnewpassword operation to reset any account's password, including administrators. The only protection is a nonce check, which is ineffective because the nonce is publicly exposed on every front-end page via wp_localize_script(). Since WordPress generates nonces for logged-out users against a shared anonymous session, any visitor can scrape a valid nonce and use it to perform the attack. This enables complete site takeover by unauthenticated attackers. No ownership token, email confirmation, or capability check is performed before executing the password reset.