CVE-2026-10830

HighCVSS 8.8/10Last modified Jul 6, 2026

Description

The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	AllCoach	< 1.0.2

References

https://wpscan.com/vulnerability/194e35d8-08ca-402d-a9bb-52383bc3dfab/

Timeline

Published: Jul 6, 2026
Last modified: Jul 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1083016.0Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-1083024.3Tanium addressed an improper access controls vulnerability in Comply.CVE-2026-1083038.8Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.CVE-2026-1083047.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-1083057.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-1083067.8Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-1083077.8Tanium addressed a heap-based buffer overflow vulnerability in Index.CVE-2026-1083086.5Tanium addressed a SQL injection vulnerability in Patch.CVE-2026-1083095.5Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.CVE-2026-108316.9A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does CVE-2026-1083105.3Tanium addressed a denial of service vulnerability in Tanium Server.CVE-2026-1083112.7Tanium addressed an insufficient logging vulnerability in Tanium Server.