What is the CVSS score of CVE-2026-10830?

CVE-2026-10830 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of AllCoach are affected by CVE-2026-10830?

The AllCoach WordPress plugin before version 1.0.2 enables account takeover of any user, including site administrators, through an unrestricted registration endpoint.. A patch is available.

Is there a public PoC exploit available for CVE-2026-10830?

Yes, a public proof-of-concept exploit is available for CVE-2026-10830. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10830?

Within 24 hours: Identify all WordPress installations using the AllCoach plugin and determine which run versions prior to 1.0.2. Within 7 days: Upgrade the AllCoach plugin to version 1.0.2 on all affected installations; if patching cannot be completed immediately, disable the plugin and establish alternative account management methods. Within 30 days: Audit account activity from the past 60 days for unauthorized password changes or access; implement multi-factor authentication on all administrator accounts; review login logs for suspicious activity.

AllCoach CVE-2026-10830

EUVD-2026-41818 HIGH

2026-07-06 WPScan

GHSA-pp48-7mg5-mw8x

WordPress Information Disclosure Allcoach

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states unauthenticated exploitation via a public endpoint with no user interaction (PR:N/UI:N/AC:L), and account takeover yields full C/I/A impact; PR:N chosen over the input's PR:L per the description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:22 vuln.today

Patch available

Jul 06, 2026 - 09:01 EUVD

CVE Published

Jul 06, 2026 - 06:00 cve.org

HIGH 8.8

CVE Published

Jul 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High, All With POC Jul 07, 2026

AnalysisAI

Account takeover in the AllCoach WordPress plugin before 1.0.2 lets remote attackers overwrite the password of any existing account - including administrators - by re-submitting that account's email address to the public account-registration endpoint, which fails to check whether the email is already tied to a user before writing a new password. Publicly available exploit code exists and a vendor patch (1.0.2) has been released, but there is no public exploit identified as actively exploited in the wild; EPSS is low (0.14%, 4th percentile) and CISA SSVC rates exploitation as 'none' despite a 'total' technical impact. The provided CVSS vector lists PR:L, which conflicts with the description's explicit 'unauthenticated attackers' claim and should be verified.

Technical ContextAI

The affected component is AllCoach, a third-party WordPress plugin that exposes its own public account-registration endpoint rather than relying solely on WordPress core registration. The root cause is a missing uniqueness/ownership check: during registration the plugin accepts an arbitrary email address and, when that email already belongs to a registered user, updates (overwrites) the stored password hash for the matching wp_users record instead of rejecting the request or requiring proof of email ownership. No CWE was assigned in the source data, but the behavior maps to CWE-640 (Weak Password Recovery / improper account-identity verification) and CWE-620 (Unverified Password Change). Because WordPress stores all roles in the same users table, the flaw applies equally to subscriber and administrator accounts. The CPE 'cpe:2.3:a:unknown:allcoach:*:*:*:*:*:*:*:*' reflects that the vendor namespace is not yet formally catalogued.

RemediationAI

Vendor-released patch: upgrade the AllCoach plugin to version 1.0.2 or later, which adds the missing check that the submitted registration email is not already associated with an existing account. This is the primary and sufficient fix; apply it immediately on all sites running AllCoach. If you cannot patch right away, deactivate and remove the AllCoach plugin (this disables the vulnerable registration endpoint entirely but also removes AllCoach functionality from the site), or restrict or disable public access to the plugin's account-registration endpoint at the web-server/WAF layer - trade-off: this may break legitimate new-user self-registration. As an interim detection/containment control, audit wp_users and recent password-change/login events for unexpected admin credential changes and force-reset administrator passwords plus invalidate active sessions, since a prior compromise would not be undone by upgrading. Reference the WPScan advisory (https://wpscan.com/vulnerability/194e35d8-08ca-402d-a9bb-52383bc3dfab/) for authoritative fix confirmation.