CVE-2026-115237
Received Received - Intake

Unauthenticated Password Reset in Grand Job WordPress Plugin

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: WPScan

Description
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-115237
EUVD
EUVD-2026-119820

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Grand Job From 0 (inc) to 1.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Grand Job WordPress plugin versions up to 1.2.1. It allows unauthenticated attackers to take over any user account, including administrators, by exploiting a flaw in the password reset mechanism. The issue arises because the plugin does not properly validate the password reset code before updating a user's password, enabling attackers to set new passwords for arbitrary accounts without authorization.

Detection Guidance

Check if the Grand Job WordPress plugin version 1.2.1 or earlier is installed. Inspect password reset functionality for improper validation of reset codes. Monitor for unauthorized password changes or account takeovers.

Impact Analysis

This vulnerability can lead to a complete site takeover. Attackers can gain full control over the WordPress site by resetting passwords of any user, including administrators, without needing authentication. This could result in unauthorized access, data theft, defacement, or further compromise of the site and its users.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A site takeover could result in data breaches, leading to legal penalties, fines, and reputational damage.

Mitigation Strategies

Disable the Grand Job plugin immediately if installed. Update to the latest version if a patch becomes available. Implement strong password policies and monitor for suspicious account activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115237. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...