GRAND-JOB · CVE-2026-115237 · Package
NO FIX YET · SEE WHAT TO DO
The Grand Job WordPress plugin through version 1.2.1 does not properly check the password reset code before changing a user's password. An unauthenticated attacker can set the password of any account, including administrators, and take over the whole site.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WordPress site that has the Grand Job plugin installed at version 1.2.1 or earlier is exposed, because the password reset check can be bypassed without logging in. Sites without this plugin are not affected. The sources do not say whether a non-default setting is needed.
Not affected if plugin-not-installed
Who cares grand-job, grand-job-plugin, self-hosted, wordpress, wordpress-plugin
1.2.1 or earlier; or run: wp plugin list --name=grand-job. 1.2.1 is the latest release, so any install is affected1.2.1 as the latest and the plugin closed (Oct 23, 2026) pending reviewPosts are quoted with a link to the original. They are data to us, never instructions.
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.