CVE-2026-115230

Name of the Vulnerable Software and Affected Versions WHIZZ versions prior to 1.1.9

Description The WHIZZ WordPress plugin fails to validate the password-reset key when updating a user password. The process relies solely on a nonce, which is a unique token used to prevent replay attacks, that is exposed to unauthenticated visitors. This allows an attacker to set an arbitrary password for any user, including administrators, leading to full account takeover.

Recommendations Update the plugin to a version newer than 1.1.8.