WordPress WHIZZ Plugin Inadequate Password Reset Validation

The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WHIZZ WordPress plugin through version 1.1.8 contains a critical authentication bypass vulnerability that allows unauthenticated attackers to reset passwords for any user account, including administrators. The vulnerability stems from improper validation of password-reset keys—the plugin relies solely on a WordPress nonce for security, but this nonce is exposed to unauthenticated visitors, defeating its intended purpose as a CSRF protection mechanism. This flaw enables complete account takeover with a CVSS score of 9.8, affecting any WordPress installation running the vulnerable plugin version. The impact is severe: attackers can gain administrative access without credentials, leading to full site compromise, data exfiltration, malware injection, and business disruption.

Casky's 224 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with MITRE technique TA0004 (Privilege Escalation). Practitioners using Casky would identify reconnaissance indicators such as repeated password-reset endpoint requests from unusual sources, anomalous nonce generation patterns, and failed authentication attempts followed by successful account access. The platform's skill detection engine would flag suspicious password change events tied to administrative accounts without corresponding login sessions, lateral movement attempts immediately following account compromises, and the exposure of reset tokens in server logs or HTTP traffic. Practitioners would see findings highlighting the combination of improper input validation (CWE-269) with broken authentication controls, allowing them to prioritize remediation, audit affected accounts for unauthorized changes, and implement enhanced logging on authentication mechanisms.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-115230.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-115230

Casky has 224 skills that investigate the attack patterns behind CVE-2026-115230. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn