External risk intelligence

Grand Job WordPress Plugin Password Reset Vulnerability Allows Full Site Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-115237

The vulnerability exists in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications, and the affected functionality—password resets—is a standard feature accessible via the web interface, making it reachable from the public internet in typical deployments.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in the Grand Job WordPress plugin allows unauthenticated attackers to take control of any website using the plugin by resetting administrative passwords. The issue arises from insufficient verification of password reset codes, potentially leading to complete site compromise. The main concern is confirming if this plugin is in use and if so, assessing the potential exposure.

Unauthenticated attackers can reset any user password.
Website takeover is possible via password reset flaws.
Confirm usage and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by targeting the password reset feature of the Grand Job WordPress plugin. By intercepting or guessing a password reset code, an attacker can bypass the intended verification process and set the password for any user account, including administrators, leading to complete website control.

No authentication needed for attack.
Password reset code verification is flawed.
Complete website takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to reset the password for any user account, including administrators, on a WordPress site running the Grand Job plugin. This could lead to a complete takeover of the website.

Website user account credentials.
Unauthenticated password reset.
Complete website takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Grand Job WordPress plugin allows unauthenticated attackers to reset passwords and gain full site control. Immediate action is required by the Application Owners and Infrastructure Teams responsible for the WordPress deployment. The first step is to identify all instances of the Grand Job plugin, confirm their reachability and business criticality, and then prioritize remediation efforts, coordinating with any necessary Vendor Management Teams if the plugin is from a third party.

Application owners should prioritize this issue.
Verify plugin presence and reachability first.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Grand Job WordPress plugin?

Grand Job is an add-on for WordPress websites, which is a popular content management system used for blogging, business sites, and e-commerce. Plugins like this extend the core functionality of a site, often adding features such as job board management, career portals, or recruitment tools that require user account interactions.

How does CVE-2026-115237 impact security?

This vulnerability is classified as Improper Authentication (CWE-287). It means the plugin fails to properly validate the security tokens or codes meant to protect the password reset process. Because this check is flawed, the software allows unauthorized users to modify account credentials without proving their identity.

Does an attacker need a valid account to trigger this bug?

No, the vulnerability does not require any existing user account or prior login. An attacker can interact with the plugin's public-facing password reset functionality directly. The flaw is not triggered by normal, authorized administrative tasks but specifically by the plugin's failure to verify the reset code provided during the reset request.

Is my website at risk from this vulnerability?

Halo Surface Signal indicates that because this plugin provides web-accessible features like password resets, it is typically reachable from the public internet. If your site runs an affected version and is configured to allow public access, it should be treated as potentially exposed to remote attackers.

How should I respond to this threat?

Begin by auditing your WordPress environment to identify if the Grand Job plugin is installed and active. Determine which instances are accessible to the internet to prioritize your work. Consult official update channels for the plugin to see if a patched version is available, and prepare to update or disable the component if a fix cannot be applied immediately.

References

wpscan.com/vulnerability/b5c809dd-9b65-4a59-b939-e5bc68912f29/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.