CVE-2026-115237: Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. The flaw allows an unauthenticated attacker to set the password for arbitrary accounts, including administrator accounts, by abusing password-reset handling.
Which accounts are at risk?
Any account whose password can be targeted is at risk, including administrator accounts. Successful exploitation can give the attacker full control of the WordPress site through an administrator account.
How can I tell whether my site may be affected?
Sites using the Grand Job WordPress plugin through version 1.2.1 may be affected. Review administrator and other user accounts for unexpected password changes or logins.