CVE-2026-115230: Admin Account Takeover in WHIZZ Plugin

CVE-2026-115230 is a critical vulnerability in WordPress plugin WHIZZ version 1.1.8 and earlier. The flaw lies in the password reset mechanism: the plugin fails to properly validate the password-reset key, relying solely on a nonce exposed to unauthenticated visitors. This defect allows an attacker to set an arbitrary password for any user account, including administrators, gaining full control of the WordPress site.

The vulnerability has a CVSS score of 9.8, classified as Critical. It was published on NVD on 2026-11-06 and represents a newly disclosed zero-day. Signals from public sources (posts on X in recent days) confirm the vulnerability is gaining attention in the security community, though with initially limited circulation. Unauthenticated access combined with maximum impact (administrative account takeover) makes this an absolute priority for defenders.

System administrators and IT teams must immediately update the WHIZZ plugin to a version beyond 1.1.8 as soon as a patch is available. If no update is yet available in the official repository, temporarily disabling the plugin is the safest mitigation. In parallel, review your administrator account access logs for anomalous activity, unauthorized password resets, or changes to privileged users in recent days. If your site uses WHIZZ, treat it as potentially compromised until proven otherwise.