CVE-2026-10830

AllCoach < 1.0.2 - Unauthenticated Account Takeover

The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.

Affected

AllCoach

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2026-07-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/194e35d8-08ca-402d-a9bb-52383bc3dfab/

References

• CVE Record
• NVD entry