CVE-2026-115237

CVSS 9.8 (critical) · published 2026-11-09

The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.

Weakness: CWE-287

Source: NVD CVE-2026-115237

References

• https://wpscan.com/vulnerability/b5c809dd-9b65-4a59-b939-e5bc68912f29/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.