AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-16298

CRITICAL · CVSS 9.8 EPSS 0.34%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The FoodBoxBooker WordPress plugin prior to version 1.0.7 is vulnerable due to inadequate validation of password reset requests, enabling unauthenticated attackers to reset passwords for any user, including administrators. This flaw poses a significant risk as it could lead to complete site takeover. WordPress site administrators using this plugin should prioritize immediate updates to mitigate potential exploitation.

CVE
CVE-2026-16298
Severity
CRITICAL
CVSS
9.8
EPSS
0.34%
WordPress

Original NVD Description

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.