CVE-2026-115237
Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.
| Vendor | unknown |
| Product | grand job |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown grand job
Be the first to know when new critical vulnerabilities affecting unknown grand job are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Grand Job
0 ≤ 1.2.1
References
Credits
WPScan