CVE-2026-115230

Overview

The WHIZZ WordPress plugin (versions up to 1.1.8) contains a critical authentication bypass vulnerability in its password reset functionality. The plugin fails to validate the password reset key, relying solely on a nonce that is accessible to unauthenticated users, allowing attackers to reset any user's password, including administrators.

Description

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.

Impact

Confidentiality, integrity, and availability are severely compromised as attackers can gain full administrative control of the WordPress site. This allows for data exfiltration, content manipulation, and potential lateral movement within the hosting environment. All users, particularly site administrators and content editors, are at immediate risk of account takeover. The lack of proper key validation renders the password reset mechanism completely insecure.

Remediation

Immediately update the WHIZZ plugin to the latest patched version released by the vendor. If an update is not available, disable the plugin or restrict access to the password reset endpoint via web application firewall (WAF) rules. Audit user accounts for unauthorized password changes and force a site-wide password reset for all privileged users. Review server logs for suspicious password reset requests from unauthenticated IPs.

Risk context

This is a critical severity vulnerability (CVSS 9.8) with a high likelihood of exploitation due to the ease of access to the vulnerable nonce. Immediate action is required to prevent full site compromise. While no EPSS score is provided, the nature of the flaw (unauthenticated admin takeover) typically results in rapid exploitation in the wild.

Affected products

• WordPress
• WHIZZ Plugin <= 1.1.8