The WHIZZ WordPress plugin up to version 1.1.8 fails to validate the password‑reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors. An attacker can set an arbitrary password for any user, including administrators, gaining full control of those accounts. This flaw allows the compromise of site credentials, potential data theft, and unauthorized modification of site content.

The vulnerability impacts the WHIZZ WordPress plugin (WHIZZ) version 1.1.8 and all earlier releases. Any WordPress site that installs or updates the plugin to this or older versions is susceptible, regardless of other security configurations.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog; however, the impact is severe due to unrestricted, unauthenticated account takeover. An attacker can retrieve the exposed nonce by accessing the plugin’s publicly visible URLs and then craft a password‑reset request without any prior session or credentials. The risk is high for any site using the affected plugin.