External risk intelligence

WHIZZ WordPress Plugin Password Reset Vulnerability Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-115230

This vulnerability affects a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications. Because the vulnerability exists within the user account management and password reset functionality, which is typically accessible to any visitor on a public website, the attack surface is considered likely to be internet-reachable in common deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in a widely used WordPress plugin allows unauthenticated attackers to reset any user's password, including administrators, leading to complete account takeover. The issue stems from inadequate validation of password-reset keys, making it possible to hijack accounts through a network-accessible process. The main concern is confirming relevance and exposure given the potential for unauthorized access and control.

Attackers can reset any user password.
Account takeover risks are high.
Confirm if this plugin is in use.

Attack Path

How an attacker could exploit the issue

An attacker could initiate an attack by targeting the password reset feature of a WordPress site that uses a vulnerable version of the WHIZZ plugin. Since the plugin exposes a nonce that unauthenticated visitors can access, an attacker could bypass security checks and manipulate the password reset process. This would allow them to set a new password for any user, including administrators, ultimately leading to complete account takeover and control of the website.

No authentication required.
Password reset functionality.
Complete account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the WHIZZ WordPress plugin could allow an unauthenticated attacker to reset any user's password, including administrators. This is possible because the plugin does not sufficiently validate the password-reset key, relying only on a nonce that is exposed to unauthenticated visitors. If exploited, an attacker could gain full control over user accounts.

User accounts and administrative access.
Unauthenticated password reset.
Complete account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Attackers can exploit this vulnerability in the WHIZZ WordPress plugin to reset any user's password, including administrators, leading to full account takeover. The primary action for security teams and system owners is to identify all instances of the affected plugin, assess their exposure and business criticality, pinpoint the accountable owner, and then plan remediation based on the identified risk.

WordPress administrators own the issue.
Verify plugin reachability and business criticality.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WHIZZ WordPress plugin?

WHIZZ is a software add-on for the WordPress content management system. Plugins like this extend the core capabilities of a website, in this case handling user account management tasks such as password resets. Administrators install them to simplify site administration or enhance user experiences.

How does CVE-2026-115230 work?

This vulnerability is classified as Improper Privilege Management (CWE-269). The plugin fails to verify the unique, secret key usually required to reset a password. Instead, it relies on a publicly visible token that any visitor can see, allowing attackers to trick the system into changing any user's password without permission.

Do I need to be logged in for this to be triggered?

No. The vulnerability does not require an attacker to have a valid user account or be authenticated to the website. The trigger condition is simply the ability to reach the password reset feature, which is typically open to all visitors. It is not triggered if the plugin is installed but the specific password reset functionality is disabled or restricted.

Why should I care about this if my site is internal?

Halo Surface Signal notes that WordPress sites are frequently public-facing, meaning this vulnerability is often reachable from the internet. Even if your site is internal, any network-based attacker with access to your private infrastructure can target this weakness to gain administrative control over your WordPress installation.

When should I take action to secure my installation?

You should prioritize this immediately, as it allows full account takeover. Start by verifying if you have the affected plugin versions installed on your systems. Once identified, consult your site's management workflow to determine the path for removing or updating the software to eliminate the insecure password reset process.

References

wpscan.com/vulnerability/8d4eeaf3-966d-4606-8e7e-326272f0d360/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.