CVE-2026-115230: WHIZZ Arbitrary Password Reset
A critical account takeover flaw affects the WHIZZ WordPress plugin. Tracked as CVE-2026-115230 (CVSS 9.8, Critical), the plugin does not validate the password-reset key before updating a user's password. It relies only on a nonce that is exposed to unauthenticated visitors, so attackers can set an arbitrary password for any user, including administrators.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-115230 |
| CVSS Score | 9.8 (Critical) |
| Affected Software | WHIZZ WordPress plugin, version 1.1.8 and earlier |
| Attack Vector | Network, unauthenticated |
| Published | November 6, 2026 |
Impact
A successful attacker gets full control of the target account. For administrator accounts that means the ability to install plugins and edit code, which usually leads to code execution on the server. Affected users would also see their password stop working.
Remediation
- Identify sites using WHIZZ.
- Remove or deactivate the plugin until a fixed version is released. NVD listed no patched version at publication.
- Check for unexpected password changes and review recent administrator logins.
- Force password resets and session invalidation for privileged users on exposed sites.