CVE-2026-115237
Grand Job
Published 9 Nov 2026 · updated 9 Nov 2026 · Received
9.8 Critical · CVSS 3.1, CISA ADP
Description
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.