---
id: "CVE-2026-115230"
page: "https://infrastack.ai/live/CVE-2026-115230"
kind: "vulnerability"
aliases: ["CVE-2026-115230"]
title: "WHIZZ WordPress plugin lets anyone reset any user's password, including admins"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "whizz", "fixed": [], "affected": "<= 1.1.8", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["account-takeover", "package", "self-hosted", "unauthenticated", "whizz-plugin", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-06T06:16:40+00:00"
first_seen_at: "2026-11-06T06:40:11+00:00"
updated_at: "2026-11-06T06:43:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115230", "first_seen_at": "2026-11-06T06:40:11+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/", "first_seen_at": "2026-11-06T06:43:24+00:00", "cites": ["https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/", "https://wordpress.org/plugins/whizz/"]}]
exploit_sources: []
---

# WHIZZ WordPress plugin lets anyone reset any user's password, including admins

Link for people: https://infrastack.ai/live/CVE-2026-115230 (this .md is for agents)

The WHIZZ WordPress plugin through 1.1.8 (the last release) does not check the password-reset key before changing a password. It relies on a nonce that unauthenticated visitors can see, so an attacker can set any user's password, administrators included, and take over the account. WordPress.org closed the plugin on December 3, 2025 and WPScan lists no fix. Remove the plugin. The exact endpoint is not public yet, and WPScan will publish the proof of concept on February 1, 2027.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:whizz affected <= 1.1.8 fixed no fixed version listed

## How to check

Check Plugins in WordPress admin (or the whizz folder under wp-content/plugins) for WHIZZ at any version up to 1.1.8; every release is affected since 1.1.8 is the latest. Also check the users table for unexpected password changes or admin logins.

## Fix

No fixed version. 1.1.8 is the last release and WordPress.org closed the plugin on December 3, 2025 (guideline violation). Deactivate and delete the plugin.

## Timeline

- 2026-11-06T06:40:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115230
- 2026-11-06T06:43:24+00:00 analyst https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/ — WPScan (researcher Muni Nitish Kumar Yaddala, CVSS 9.8) says unauthenticated arbitrary password reset in <= 1.1.8, no known fix; wordpress.org page shows plugin closed since 2025-12-03, last version 1.1.8. WPScan PoC withheld until 2027-02-01. Exact endpoint/setting not published. No exploitation evidence found; X not checked. Nothing marked verified: WPScan is not the vendor's page.

## Documents

- [advisory] WPScan: WHIZZ <= 1.1.8 Unauthenticated Arbitrary User Password Reset https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/
- [describes] WHIZZ plugin page (closed Dec 3, 2025) https://wordpress.org/plugins/whizz/

## From the sources

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_