What is GHSA-4qqw-wh2v-hr89?

GHSA-4qqw-wh2v-hr89 is a security advisory published by GitHub Security Advisories with Critical severity. The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code...

Which CVE IDs does GHSA-4qqw-wh2v-hr89 cover?

GHSA-4qqw-wh2v-hr89 covers the following CVE IDs: CVE-2026-115237. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4qqw-wh2v-hr89?

GHSA-4qqw-wh2v-hr89 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-4qqw-wh2v-hr89CriticalCVSS 9.8

The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code...

Vendor

GitHub Security Advisories

Published

November 9, 2026

Last Modified

November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-115237 →

📋 Description

The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-115237
https://wpscan.com/vulnerability/b5c809dd-9b65-4a59-b939-e5bc68912f29
https://github.com/advisories/GHSA-4qqw-wh2v-hr89