WordPress Plugin Vulnerabilities

Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code

Description

The plugin does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.

Proof of Concept

Affects Plugins

Plugin icon
grand-job
No known fix

References

CVE
CVE-2026-115237

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Verified
Yes
WPVDB ID
b5c809dd-9b65-4a59-b939-e5bc68912f29

Timeline

Publicly Published
2026-11-06 (about 3 days ago)
Added
2026-11-06 (about 2 days ago)
Last Updated
2026-11-07 (about 1 day ago)

Other

Published
Title
Published
2020-04-28
Title
LearnPress < 3.2.6.9 - Authenticated Post Creation and Status Modification
Published
2025-02-12
Title
WP Directorybox Manager <= 2.5 - Authentication Bypass
Published
2026-10-27
Title
Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter
Published
2026-06-25
Title
Abandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link Token
Published
2024-07-13
Title
Backup and Staging by WP Time Capsule < 1.22.21 - Authentication Bypass to Account Takeover