CVE-2026-115230: WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset

Q: Who can exploit this issue?

Unauthenticated visitors can exploit it because the required nonce is exposed to unauthenticated users. No existing account or login is required.

Q: What access can an attacker gain?

An attacker can set a new password for any WordPress user, including an administrator. This can result in full takeover of the targeted account.

Q: Which plugin versions are affected?

WHIZZ versions through 1.1.8 are affected.

Q: How can I tell whether an account may have been compromised?

Review for unexpected password changes or accounts that can no longer be accessed with their prior credentials, especially administrator accounts. The provided information does not identify specific logs or indicators for exploitation.

Published Nov 6, 2026

Updated

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated visitors can exploit it because the required nonce is exposed to unauthenticated users. No existing account or login is required.

What access can an attacker gain?

An attacker can set a new password for any WordPress user, including an administrator. This can result in full takeover of the targeted account.

Which plugin versions are affected?

WHIZZ versions through 1.1.8 are affected.

How can I tell whether an account may have been compromised?

Review for unexpected password changes or accounts that can no longer be accessed with their prior credentials, especially administrator accounts. The provided information does not identify specific logs or indicators for exploitation.

CVE-2026-115230: WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

Which plugin versions are affected?

How can I tell whether an account may have been compromised?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

Which plugin versions are affected?

How can I tell whether an account may have been compromised?