CVE-2026-16298
FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset
CVSS Score
9.8
EPSS Score
0.1%
EPSS Percentile
4th
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
| Vendor | unknown |
| Product | foodboxbooker |
| Published | Aug 10, 2026 |
| Last Updated | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown foodboxbooker
Be the first to know when new critical vulnerabilities affecting unknown foodboxbooker are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / FoodBoxBooker
0 < 1.0.7
References
Credits
moonge WPScan