CVE-2026-18200

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.15% chance of exploitation in the next 30 days, 5th percentile

Published

2026-08-10

Updated

2026-08-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a5864653-4df6-4d8d-9f8a-ace7b0220342/

References

• CVE Record
• NVD entry

Related

• CVE-2026-1814
• CVE-2026-18202
• CVE-2026-1813
• CVE-2026-18216
• CVE-2026-1812
• CVE-2026-18220