CVE-2026-10830
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The AllCoach WordPress plugin before version 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password. This allows unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.
Risk Assessment
The risk for the organization is critical – an unauthenticated attacker can take over an administrator account and the entire WordPress site, leading to complete loss of control and potential data breach.
Recommendation
Immediately update the AllCoach plugin to version 1.0.2 or later. If an update is not possible, temporarily disable the plugin until it can be applied.
Original NVD description (English source)
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.