CVE-2026-16298CWE-269privilege-escalation

CVE-2026-16298

Critical · published August 10, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-08-10T11:16Z
References (1)
https://wpscan.com/vulnerability/d554361c-e6c7-4843-a9cc-005b08685a5b/ · [email protected]
EPSS history
Timeline
  • 10 AUG 06:00Z
    FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset
    cvelistv5