{"affected":[{"defaultStatus":"unknown","product":"WHIZZ","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.1.8","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-115230","cwes":["CWE-269"],"description":"The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/"}],"kev":null,"metrics":[],"modifiedAt":1793944825263,"publishedAt":1793944825263,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/"}],"remediation":[],"revision":"36afeee3dc10453df43523842693f4cc867b584e6b683903e776c7d4a79a699f","sources":[{"modifiedAt":1793944825263,"name":"CNA: WPScan","retrievedAt":1793945314719,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115230"}],"ssvc":null,"status":"published","title":"WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset","updatedAt":1793945314719}