CVE-2026-115230

Full vulnerability record from the local CVENow database.

Description

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 06:16:40.270000

Last modified

2026-11-06 06:16:40.270000

View original CVE JSON

{
  "id": "CVE-2026-115230",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T06:16:40.270",
  "lastModified": "2026-11-06T06:16:40.270",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "WHIZZ",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.1.8",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/",
      "source": "[email protected]"
    }
  ]
}