Description

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T06:16:40.270Z",
  "pubdate": "2026-11-06T06:16:40.270Z",
  "executiveSummary": "The WHIZZ WordPress plugin, in all versions up to 1.1.8, contains a critical authentication bypass vulnerability related to the password reset mechanism.\nThe flaw stems from insufficient validation logic where the plugin fails to verify the cryptographically secure password-reset key sent to users, relying instead on a predictable or exposed nonce.\nThis vulnerability allows unauthenticated remote attackers to perform a full account takeover by setting arbitrary passwords for any registered user, including those with administrative privileges.\nThe security implications are severe, as an attacker can compromise any account on the system without requiring prior access or interaction with the victim.\nThis vulnerability is categorized as an authentication bypass or improper authentication flaw. Exploitation is trivial, requiring only knowledge of a target's username and the ability to interact with the plugin's password-reset endpoint.\nThe vulnerability is currently unpatched in the specified versions, necessitating immediate defensive action by site administrators.",
  "technicalDetails": "The vulnerability resides within the password recovery workflow of the WHIZZ WordPress plugin. In standard WordPress implementations, the password reset process involves generating a unique, time-sensitive key (hashed) that is associated with a specific user and delivered via email.\nThe WHIZZ plugin fails to enforce the validation of this unique reset key during the password update phase. Instead, the implementation relies exclusively on a nonce parameter intended for Cross-Site Request Forgery (CSRF) protection. In this specific context, the nonce is inadequately handled and remains exposed to unauthenticated visitors through the plugin's frontend components or source code.\nBecause the system treats this exposed nonce as a sufficient token for verifying a password reset request, the backend logic effectively bypasses the requirement for a legitimate, user-specific reset token.\nThe attack flow begins when an attacker identifies the target user's username or email address. The attacker then initiates a password reset request via the plugin's interface. Because the plugin performs no validation on the cryptographically significant reset key, the attacker can submit a crafted HTTP request containing the exposed nonce and the desired new password.\nUpon receiving the request, the server-side code processes the password change without verifying whether the request was legitimately authorized by the account owner. The plugin updates the user's password in the 'wp_users' table to the attacker-defined value.\nThis results in a total account takeover. Since the attacker can target any user on the platform, including accounts with the 'administrator' role, this vulnerability leads to a complete compromise of the WordPress installation, potentially allowing for remote code execution (via plugin/theme uploads) and full database exfiltration.\nThe vulnerable code is exposed directly over the network without the requirement for pre-existing authentication or specific session privileges, meeting the criteria for a high-severity, remotely exploitable authentication bypass vulnerability.\nVersions affected: WHIZZ WordPress plugin through 1.1.8."
}