WHIZZ CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL WHIZZ CVE published 2026-11-06

CVE-2026-115230

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors. This vulnerability allows attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts. The vulnerability is particularly concerning for WordPress installations with exp [truncated]