{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/the-grand-job--1.2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:the_grand_job:the_grand_job:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-115237"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["The Grand Job (\u003c= 1.2.1)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","authentication-bypass","cve"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Grand Job WordPress plugin (versions 1.2.1 and earlier) fails to properly validate password reset codes during the password reset process. This flaw allows unauthenticated remote attackers to update the passwords of arbitrary user accounts, including those with administrative privileges, leading to full site takeover.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full site compromise by granting the attacker administrative control over the affected WordPress installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress instances utilizing \u0026quot;The Grand Job\u0026quot; plugin.\u003c/li\u003e\n\u003cli\u003eDisable or remove the plugin until a patch is released by the developer.\u003c/li\u003e\n\u003cli\u003eAudit administrative user account logs for unexpected password changes occurring since the discovery of this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T15:51:08Z","date_published":"2026-11-09T15:51:08Z","id":"https://feed.craftedsignal.io/briefs/2026-11-grand-job-bypass/","summary":"The Grand Job WordPress plugin through 1.2.1 contains an authentication bypass vulnerability allowing unauthenticated attackers to reset the passwords of arbitrary users, including administrators.","title":"The Grand Job WordPress plugin: Authentication bypass via password reset (CVE-2026-115237)","url":"https://feed.craftedsignal.io/briefs/2026-11-grand-job-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - The Grand Job (\u003c= 1.2.1)","version":"https://jsonfeed.org/version/1.1"}