WordPress Plugin Vulnerabilities

FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update

Description

The plugin does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators.

Proof of Concept

Affects Plugins

Plugin icon
foodboxbooker
Fixed in 1.0.8

References

CVE
CVE-2026-18200

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
a5864653-4df6-4d8d-9f8a-ace7b0220342

Timeline

Publicly Published
2026-08-07 (about 3 days ago)
Added
2026-08-07 (about 2 days ago)
Last Updated
2026-08-07 (about 2 days ago)

Other

Published
Title
Published
2022-10-04
Title
WooCommerce Products Vendor < 2.1.66 - Note Creation via IDOR
Published
2024-12-02
Title
WPCasa < 1.3.0 - Insecure Direct Object Reference
Published
2024-08-15
Title
Custom Field For WP Job Manager < 1.3 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode
Published
2024-03-13
Title
Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form < 2.10.2 - Unauthenticated Insecure Direct Object Reference to Form Submission Alteration
Published
2023-10-09
Title
WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR