CVE Catalog
CVE-2026-16298
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.15%
4th percentile - higher than 4% of all known CVEs
Summary
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
Risk Assessment
Risk of full WordPress site takeover, loss of control over content and user data.
Recommendation
Update the FoodBoxBooker plugin to version 1.0.7 or later.
Original NVD description (English source)
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.