The Grand Job WordPress plugin: Authentication bypass via password reset (CVE-2026-115237)
The Grand Job WordPress plugin through 1.2.1 contains an authentication bypass vulnerability allowing unauthenticated attackers to reset the passwords of arbitrary users, including administrators.
CVE search metadata
CVE search record: CVE-2026-115237. Severity: critical. CVSS: 9.8. KEV: no. Product: The Grand Job (<= 1.2.1). Brief: The Grand Job WordPress plugin: Authentication bypass via password reset (CVE-2026-115237). Brief link: https://feed.craftedsignal.io/briefs/2026-11-grand-job-bypass/
Triage facts
Revision 1- Applicability
- The Grand Job (<= 1.2.1)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 15:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Grand Job WordPress plugin (versions 1.2.1 and earlier) fails to properly validate password reset codes during the password reset process. This flaw allows unauthenticated remote attackers to update the passwords of arbitrary user accounts, including those with administrative privileges, leading to full site takeover.
Impact
Successful exploitation allows for full site compromise by granting the attacker administrative control over the affected WordPress installation.
Recommendation
- Inventory all WordPress instances utilizing "The Grand Job" plugin.
- Disable or remove the plugin until a patch is released by the developer.
- Audit administrative user account logs for unexpected password changes occurring since the discovery of this vulnerability.
Immediate actions
Disable or uninstall The Grand Job plugin on all production WordPress sites.
Threat Hunt
Hunt for suspicious HTTP POST requests targeting WordPress password reset endpoints where the reset token validation is skipped or bypassed.
Data: Web server access logs (Apache/Nginx)
Mitigations
Disable plugin and reset credentials for all administrative accounts if compromise is suspected.
CVE-2026-115237