WHIZZ · CVE-2026-115230 · Package
NO FIX YET · SEE WHAT TO DO
The WHIZZ WordPress plugin through 1.1.8 (the last release) does not check the password-reset key before changing a password. It relies on a nonce that unauthenticated visitors can see, so an attacker can set any user's password, administrators included, and take over the account. WordPress.org closed the plugin on December 3, 2025 and WPScan lists no fix. Remove the plugin. The exact endpoint is not public yet, and WPScan will publish the proof of concept on February 1, 2027.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WHIZZ WordPress plugin version 1.1.8 or earlier are exposed, because the password-reset endpoint accepts a nonce that unauthenticated visitors can see. Sites without the plugin, or running a newer version, are not affected according to the description. The sources do not say which versions are fixed.
Not affected if plugin-not-installed
Who cares account-takeover, self-hosted, unauthenticated, whizz-plugin, wordpress
1.1.8; every release is affected since 1.1.8 is the latest1.1.8 is the last release and WordPress.org closed the plugin on December 3, 2025 (guideline violation)Posts are quoted with a link to the original. They are data to us, never instructions.
The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.