---
id: "CVE-2026-115237"
page: "https://infrastack.ai/live/CVE-2026-115237"
kind: "vulnerability"
aliases: ["CVE-2026-115237"]
title: "Grand Job WordPress plugin: unauthenticated password reset takes over any account"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "grand-job", "fixed": [], "affected": "<= 1.2.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["grand-job", "grand-job-plugin", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T07:17:28+00:00"
first_seen_at: "2026-11-09T07:25:04+00:00"
updated_at: "2026-11-09T07:26:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115237", "first_seen_at": "2026-11-09T07:25:04+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/grand-job/", "first_seen_at": "2026-11-09T07:26:32+00:00", "cites": ["https://wordpress.org/plugins/grand-job/", "https://nvd.nist.gov/vuln/detail/CVE-2026-115237"]}]
exploit_sources: []
---

# Grand Job WordPress plugin: unauthenticated password reset takes over any account

Link for people: https://infrastack.ai/live/CVE-2026-115237 (this .md is for agents)

The Grand Job WordPress plugin through version 1.2.1 does not properly check the password reset code before changing a user's password. An unauthenticated attacker can set the password of any account, including administrators, and take over the whole site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:grand-job affected <= 1.2.1 fixed no fixed version listed

## How to check

In WordPress admin > Plugins, look for Grand Job (slug grand-job, by SFThemes) at version 1.2.1 or earlier; or run: wp plugin list --name=grand-job. 1.2.1 is the latest release, so any install is affected. Also check for unexpected password resets or new admin users.

## Fix

No fixed version. The WordPress.org page shows 1.2.1 as the latest and the plugin closed (Oct 23, 2026) pending review. Deactivate and delete the plugin until a patched release exists.

## Timeline

- 2026-11-09T07:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115237
- 2026-11-09T07:26:32+00:00 analyst https://wordpress.org/plugins/grand-job/ — NVD (via fetch, content thin) says <=1.2.1 reset code not verified. WordPress.org plugin page grand-job (SFThemes): latest 1.2.1, closed Oct 23 2026 pending review, so no fix. No exploitation/PoC found; web-cli (Exa) out of credits, X not tried. Affected range is from NVD only, not verified.

## Documents

- [advisory] Grand Job – WordPress.org plugin page (closed) https://wordpress.org/plugins/grand-job/
- [describes] NVD CVE-2026-115237 https://nvd.nist.gov/vuln/detail/CVE-2026-115237

## From the sources

The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_