WHIZZ: account takeover via password reset (CVE-2026-115230)
A vulnerability, CVE-2026-115230 (CVSS 9.8), was reported in the WHIZZ WordPress plugin. It does not validate the password-reset key before changing a password and relies only on a nonce that is exposed to unauthenticated visitors.
Checked in Shield: no
Who is affected
WordPress sites running the WHIZZ plugin version 1.1.8 or earlier. An attacker can set an arbitrary password for any user, including administrators, and take over the account.
How to check
In the WordPress admin, open the Plugins page and check whether WHIZZ is installed and which version it is. Version 1.1.8 and below is affected.
How to fix
The source does not name a fixed version. If you do not need WHIZZ, deactivate and delete it. If you do, watch for an update and install it as soon as it is released.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
A fixed version and any exploitation data are not disclosed yet. Source: NVD.
