Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code

The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and fully take over the site.