WordPress Plugin Vulnerabilities

FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset

Description

The plugin does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

Proof of Concept

Affects Plugins

Plugin icon
foodboxbooker
Fixed in 1.0.7

References

CVE
CVE-2026-16298

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
moonge
Submitter
moonge
Verified
Yes
WPVDB ID
d554361c-e6c7-4843-a9cc-005b08685a5b

Timeline

Publicly Published
2026-08-05 (about 5 days ago)
Added
2026-08-05 (about 4 days ago)
Last Updated
2026-08-07 (about 2 days ago)

Other

Published
Title
Published
2026-02-20
Title
Wholesale Suite < 2.2.7 - Authenticated (Shop Manager) Privilege Escalation
Published
2025-07-11
Title
The E-Commerce ERP <= 2.1.1.3 - Unauthenticated Privilege Escalation
Published
2026-05-22
Title
Wishlist Member < 3.31.0 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action
Published
2026-01-22
Title
Institutions Directory <= 1.3.4 - Subscriber+ Privilege Escalation
Published
2025-03-18
Title
BoomBox Theme Extensions < 1.8.1 - Subscriber+ Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password