{"id":"CVE-2026-115237","kind":"vulnerability","aliases":["CVE-2026-115237"],"related":[],"title":"Grand Job WordPress plugin: unauthenticated password reset takes over any account","description":"The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.","summary":"The Grand Job WordPress plugin through version 1.2.1 does not properly check the password reset code before changing a user's password. An unauthenticated attacker can set the password of any account, including administrators, and take over the whole site.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"grand-job","fixed":[],"affected":"<= 1.2.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["grand-job","grand-job-plugin","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, look for Grand Job (slug grand-job, by SFThemes) at version 1.2.1 or earlier; or run: wp plugin list --name=grand-job. 1.2.1 is the latest release, so any install is affected. Also check for unexpected password resets or new admin users.","fix":"No fixed version. The WordPress.org page shows 1.2.1 as the latest and the plugin closed (Oct 23, 2026) pending review. Deactivate and delete the plugin until a patched release exists.","status":"open","published_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:49+00:00","updated_at":"2026-11-09T07:26:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T07:25:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Grand Job WordPress plugin: unauthenticated password reset takes over any account","impact":"high","summary":"The Grand Job WordPress plugin through version 1.2.1 does not properly check the password reset code before changing a user's password. An unauthenticated attacker can set the password of any account, including administrators, and take over the whole site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","grand-job-plugin","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker takes over any account, including administrators","analyst_note":"Confirm the fixed version and plugin slug on the WordPress plugin page or NVD; the sources give no fixed version.","how_to_check":"- Check whether the `grand-job` plugin is installed and its version is `1.2.1` or earlier in the WordPress admin under Plugins.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site that has the Grand Job plugin installed at version 1.2.1 or earlier is exposed, because the password reset check can be bypassed without logging in. Sites without this plugin are not affected. The sources do not say whether a non-default setting is needed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000713,"input_tokens":4526,"output_tokens":520,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and plugin slug on the WordPress plugin page or NVD; the sources give no fixed version.","search":"'-115237':14A,17A '-2026':13A,16A '1.2.1':43B,82C 'account':11A,67B,106C 'administr':69B,108C 'allow':97C 'arbitrari':105C 'attack':60B,99C 'chang':53B 'check':47B 'code':51B,90C 'correct':85C 'cve':12A,15A 'fulli':110C 'grand':1A,19A,22B,25B,37B,77C 'grand-job':18A,21B 'grand-job-plugin':24B 'host':31B 'includ':68B,107C 'job':2A,20A,23B,26B,38B,78C 'packag':28B 'password':6A,49B,57B,64B,88C,96C,103C 'plugin':4A,27B,35B,40B,80C 'proper':46B 'reset':7A,50B,89C 'self':30B 'self-host':29B 'set':62B,101C 'site':75B,114C 'take':8A,71B,111C 'unauthent':5A,59B,98C 'updat':92C 'user':55B,94C 'verifi':86C 'version':42B 'whole':74B 'wordpress':3A,32B,34B,39B,79C 'wordpress-plugin':33B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site that has the Grand Job plugin installed at version 1.2.1 or earlier is exposed, because the password reset check can be bypassed without logging in. Sites without this plugin are not affected. The sources do not say whether a non-default setting is needed.","tier":"B","verified":{"fix":{"at":"2026-11-09T07:26:32Z","by":"analyst","doc":"https://wordpress.org/plugins/grand-job/","run_id":2251}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["grandjob"],"ptokens":["grand","job"],"labels":["critical","grandjob","grandjobplugin","package","selfhosted","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-115237':14A,17A '-2026':13A,16A 'account':11A 'cve':12A,15A 'grand':1A,19A 'grand-job':18A 'job':2A,20A 'password':6A 'plugin':4A 'reset':7A 'take':8A 'unauthent':5A 'wordpress':3A","search_b":"'1.2.1':43B 'account':67B 'administr':69B 'attack':60B 'chang':53B 'check':47B 'code':51B 'grand':22B,25B,37B 'grand-job':21B 'grand-job-plugin':24B 'host':31B 'includ':68B 'job':23B,26B,38B 'packag':28B 'password':49B,57B,64B 'plugin':27B,35B,40B 'proper':46B 'reset':50B 'self':30B 'self-host':29B 'set':62B 'site':75B 'take':71B 'unauthent':59B 'user':55B 'version':42B 'whole':74B 'wordpress':32B,34B,39B 'wordpress-plugin':33B","search_c":"'1.2.1':82C 'account':106C 'administr':108C 'allow':97C 'arbitrari':105C 'attack':99C 'code':90C 'correct':85C 'fulli':110C 'grand':77C 'includ':107C 'job':78C 'password':88C,96C,103C 'plugin':80C 'reset':89C 'set':101C 'site':114C 'take':111C 'unauthent':98C 'updat':92C 'user':94C 'verifi':86C 'wordpress':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115237","severity":null,"published_at":"2026-11-09T07:17:28+00:00","modified_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115237:2251","url":"https://wordpress.org/plugins/grand-job/","severity":null,"published_at":"2026-11-09T07:26:32+00:00","modified_at":"2026-11-09T07:26:32+00:00","first_seen_at":"2026-11-09T07:26:32+00:00","fetched_at":"2026-11-09T07:26:32+00:00","note":"NVD (via fetch, content thin) says <=1.2.1 reset code not verified. WordPress.org plugin page grand-job (SFThemes): latest 1.2.1, closed Oct 23 2026 pending review, so no fix. No exploitation/PoC found; web-cli (Exa) out of credits, X not tried. Affected range is from NVD only, not verified.","cites":["https://wordpress.org/plugins/grand-job/","https://nvd.nist.gov/vuln/detail/CVE-2026-115237"]}],"documents":[{"id":106364,"url":"https://wordpress.org/plugins/grand-job/","title":"Grand Job – WordPress.org plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"Plugin grand-job by SFThemes. Current version 1.2.1. Closed as of October 23, 2026, not available for download, temporarily pending a full review. Last updated July 2022.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":106365,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115237","title":"NVD CVE-2026-115237","kind":"advisory","source":"analyst","publisher":null,"text":"Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}