{"id":"CVE-2026-115230","kind":"vulnerability","aliases":["CVE-2026-115230"],"related":[],"title":"WHIZZ WordPress plugin lets anyone reset any user's password, including admins","description":"The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.","summary":"The WHIZZ WordPress plugin through 1.1.8 (the last release) does not check the password-reset key before changing a password. It relies on a nonce that unauthenticated visitors can see, so an attacker can set any user's password, administrators included, and take over the account. WordPress.org closed the plugin on December 3, 2025 and WPScan lists no fix. Remove the plugin. The exact endpoint is not public yet, and WPScan will publish the proof of concept on February 1, 2027.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"whizz","fixed":[],"affected":"<= 1.1.8","ecosystem":"wordpress"}],"ecosystems":[],"tags":["account-takeover","package","self-hosted","unauthenticated","whizz-plugin","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Check Plugins in WordPress admin (or the whizz folder under wp-content/plugins) for WHIZZ at any version up to 1.1.8; every release is affected since 1.1.8 is the latest. Also check the users table for unexpected password changes or admin logins.","fix":"No fixed version. 1.1.8 is the last release and WordPress.org closed the plugin on December 3, 2025 (guideline violation). Deactivate and delete the plugin.","status":"open","published_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:41:57+00:00","updated_at":"2026-11-06T06:43:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T06:41:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WHIZZ WordPress plugin lets anyone reset any user's password, including admins","impact":"high","summary":"The WHIZZ WordPress plugin through 1.1.8 does not check the password-reset key before changing a user's password. Its only check is a nonce that is visible to unauthenticated visitors, so an attacker can set any account's password, including administrators, and take the account over.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","whizz-plugin","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker takes over any WordPress account, including administrators.","analyst_note":"Find the vendor or WordPress.org advisory for a fixed version of the WHIZZ plugin and confirm the affected endpoint and setting.","how_to_check":"- Check whether the WHIZZ plugin is installed and its version is `1.1.8` or earlier, in the WordPress admin under Plugins or in the plugin's `readme.txt`\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WHIZZ WordPress plugin version 1.1.8 or earlier are exposed, because the password-reset endpoint accepts a nonce that unauthenticated visitors can see. Sites without the plugin, or running a newer version, are not affected according to the description. The sources do not say which versions are fixed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00071,"input_tokens":4219,"output_tokens":576,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor or WordPress.org advisory for a fixed version of the WHIZZ plugin and confirm the affected endpoint and setting.","search":"'-115230':15A,18A '-2026':14A,17A '1':112B '1.1.8':37B,119C '2025':86B '2027':113B '3':85B 'account':21B,78B,162C 'account-takeov':20B 'admin':12A 'administr':72B,156C 'allow':145C 'anyon':5A 'arbitrari':150C 'attack':65B,146C 'chang':50B 'check':43B 'close':80B 'concept':109B 'cve':13A,16A 'decemb':84B 'endpoint':97B 'exact':96B 'expos':141C 'februari':111B 'fix':91B 'fulli':158C 'host':26B 'includ':11A,73B,155C 'key':48B,127C 'last':39B 'let':4A 'list':89B 'nonc':57B,138C 'packag':23B 'password':10A,46B,52B,71B,125C,133C,151C 'password-reset':45B,124C 'plugin':3A,30B,35B,82B,94B,117C 'proof':107B 'public':100B 'publish':105B 'releas':40B 'reli':54B,134C 'remov':92B 'reset':6A,47B,126C 'see':62B 'self':25B 'self-host':24B 'set':67B,148C 'take':75B,159C 'takeov':22B 'unauthent':27B,59B,143C 'updat':129C 'user':8A,69B,131C,154C 'valid':122C 'visitor':60B,144C 'whizz':1A,19A,29B,33B,115C 'whizz-plugin':28B 'wordpress':2A,31B,34B,116C 'wordpress.org':79B 'wpscan':88B,103B 'yet':101B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WHIZZ WordPress plugin version 1.1.8 or earlier are exposed, because the password-reset endpoint accepts a nonce that unauthenticated visitors can see. Sites without the plugin, or running a newer version, are not affected according to the description. The sources do not say which versions are fixed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["whizz"],"ptokens":["whizz"],"labels":["accounttakeover","critical","package","selfhosted","unauthenticated","whizzplugin","wordpress"],"campaign_type":null,"search_a":"'-115230':15A,18A '-2026':14A,17A 'admin':12A 'anyon':5A 'cve':13A,16A 'includ':11A 'let':4A 'password':10A 'plugin':3A 'reset':6A 'user':8A 'whizz':1A,19A 'wordpress':2A","search_b":"'1':112B '1.1.8':37B '2025':86B '2027':113B '3':85B 'account':21B,78B 'account-takeov':20B 'administr':72B 'attack':65B 'chang':50B 'check':43B 'close':80B 'concept':109B 'decemb':84B 'endpoint':97B 'exact':96B 'februari':111B 'fix':91B 'host':26B 'includ':73B 'key':48B 'last':39B 'list':89B 'nonc':57B 'packag':23B 'password':46B,52B,71B 'password-reset':45B 'plugin':30B,35B,82B,94B 'proof':107B 'public':100B 'publish':105B 'releas':40B 'reli':54B 'remov':92B 'reset':47B 'see':62B 'self':25B 'self-host':24B 'set':67B 'take':75B 'takeov':22B 'unauthent':27B,59B 'user':69B 'visitor':60B 'whizz':29B,33B 'whizz-plugin':28B 'wordpress':31B,34B 'wordpress.org':79B 'wpscan':88B,103B 'yet':101B","search_c":"'1.1.8':119C 'account':162C 'administr':156C 'allow':145C 'arbitrari':150C 'attack':146C 'expos':141C 'fulli':158C 'includ':155C 'key':127C 'nonc':138C 'password':125C,133C,151C 'password-reset':124C 'plugin':117C 'reli':134C 'reset':126C 'set':148C 'take':159C 'unauthent':143C 'updat':129C 'user':131C,154C 'valid':122C 'visitor':144C 'whizz':115C 'wordpress':116C","first_public_at":"2026-11-06T06:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115230","severity":null,"published_at":"2026-11-06T06:16:40+00:00","modified_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115230:1864","url":"https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/","severity":null,"published_at":"2026-11-06T06:43:24+00:00","modified_at":"2026-11-06T06:43:24+00:00","first_seen_at":"2026-11-06T06:43:24+00:00","fetched_at":"2026-11-06T06:43:24+00:00","note":"WPScan (researcher Muni Nitish Kumar Yaddala, CVSS 9.8) says unauthenticated arbitrary password reset in <= 1.1.8, no known fix; wordpress.org page shows plugin closed since 2025-12-03, last version 1.1.8. WPScan PoC withheld until 2027-02-01. Exact endpoint/setting not published. No exploitation evidence found; X not checked. Nothing marked verified: WPScan is not the vendor's page.","cites":["https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/","https://wordpress.org/plugins/whizz/"]}],"documents":[{"id":84161,"url":"https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/","title":"WPScan: WHIZZ <= 1.1.8 Unauthenticated Arbitrary User Password Reset","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":84162,"url":"https://wordpress.org/plugins/whizz/","title":"WHIZZ plugin page (closed Dec 3, 2025)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}