CVE-2026-115237

Summary

The Grand Job WordPress plugin (<=1.2.1) fails to properly validate password reset codes, enabling unauthenticated users to bypass authentication and reset passwords for any user account, including administrators. This allows full site compromise without requiring credentials or user interaction.

Exploitability

Trivial to exploit; requires only sending a specially crafted HTTP request to the plugin's password reset endpoint with a known username and arbitrary new password.

Blast radius

Complete site takeover is possible, granting attackers full administrative control over WordPress, including data exfiltration, malware deployment, and persistence establishment.

Detection

Look for repeated POST requests to /wp-admin/admin-ajax.php?action=grand_job_reset_password (or similar plugin endpoint) with valid usernames but non-matching or missing reset tokens; anomalous password change events in WordPress user logs without corresponding email notifications may also indicate exploitation.

Prioritized remediation

Upgrade to Grand Job plugin version 1.2.2 or later, which includes proper validation of password reset codes.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.