blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-10830

HIGH 8.8 CVSS 3.1
Published
July 6, 2026
Last modified
July 6, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown AllCoach — Before 1.0.2

References

  • wpscan.com https://wpscan.com/vulnerability/194e35d8-08ca-402d-a9bb-52383bc3dfab/
  • nvd.nist.gov Official NVD record