CVE-2026-115237Grand Job

<= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code

Not on CISA's list of exploited flaws, and not in the news we track.

Chance of exploitation in 30 daysEPSS

0.14%

0%Higher than 3% of all CVEs

Exploited in the wild: Not confirmedBy CISA
Severity: 9.8 of 10Critical, CVSS
Used in ransomware: Not known
US federal deadline: None set

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-115237. Nothing runs until you send it.

About this flaw

The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.