{"affected":[{"defaultStatus":"unknown","product":"Grand Job","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.2.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-115237","cwes":["CWE-287"],"description":"The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/b5c809dd-9b65-4a59-b939-e5bc68912f29/"}],"kev":null,"metrics":[],"modifiedAt":1794204026198,"publishedAt":1794204026198,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/b5c809dd-9b65-4a59-b939-e5bc68912f29/"}],"remediation":[],"revision":"0fc1dcd269628300586f4e762eb26bfb8d78a082c9715e1d2242b7c97ab75ea9","sources":[{"modifiedAt":1794204026198,"name":"CNA: WPScan","retrievedAt":1794208108511,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115237"}],"ssvc":null,"status":"published","title":"Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code","updatedAt":1794208108511}