EUVD-2026-41818
GHSA-pp48-7mg5-mw8x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEnumerate target admin email address
-
DeliverySubmit email to public registration endpoint
-
ExploitPlugin overwrites existing user's password
-
ExecutionLog in to /wp-admin with new password
-
ImpactFull site/administrator takeover
Vulnerability Assessment
| Exploitation Conditions | The target WordPress site must have the AllCoach plugin (version < 1.0.2) installed and active, exposing its public account-registration endpoint. The attacker must know or guess the email address of the account they wish to hijack (administrator emails are frequently discoverable via author archives, REST endpoints, or public contact pages). Per the description no authentication is required (unauthenticated attackers), and no user interaction by the victim is needed; the main limiting factor is knowledge of a valid target email plus reachability of the registration endpoint. NOTE: the supplied CVSS vector's PR:L would imply an authenticated prerequisite, which contradicts the description - treat the description (unauthenticated) as authoritative and verify with the vendor advisory. |
| Impact | Signals are mixed. The technical impact is severe - SSVC rates Technical Impact as 'total' and the assessed impact is full account/site takeover (C:H/I:H/A:H), consistent with the 8.8 base score. However, exploitation-likelihood signals are low-to-moderate: EPSS is only 0.14% (4th percentile), SSVC Exploitation is 'none' (not observed in the wild), SSVC Automatable is 'no', and the vulnerability is not in CISA KEV. Publicly available exploit code exists (WPScan), which raises practical risk above the raw EPSS number, but POC availability is not active exploitation. A key data conflict must be flagged: the supplied CVSS vector specifies PR:L (authenticated), yet the description states 'unauthenticated attackers' can reset arbitrary passwords via a public endpoint - if the description is correct, real-world risk is HIGHER than the vector implies (this should be PR:N). Net: a genuinely high-impact, low-complexity flaw in a niche plugin; prioritize patching for any site running AllCoach, but broad opportunistic mass-exploitation is not currently evidenced. |
| Exploit ScenarioDerived | An attacker who knows or guesses a target site's administrator email address submits it to AllCoach's public account-registration endpoint together with an attacker-chosen password; because the plugin does not verify the email is already in use, it overwrites the administrator's stored password. The attacker then logs in to /wp-admin with the new password and takes full control of the site. Publicly available exploit code (WPScan) makes this low-effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Account takeover in the AllCoach WordPress plugin before 1.0.2 lets remote attackers overwrite the password of any existing account - including administrators - by re-submitting that account's email address to the public account-registration endpoint, which fails to check whether the email is already tied to a user before writing a new password. Publicly available exploit code exists and a vendor patch (1.0.2) has been released, but there is no public exploit identified as actively exploited in the wild; EPSS is low (0.14%, 4th percentile) and CISA SSVC rates exploitation as 'none' despite a 'total' technical impact. The provided CVSS vector lists PR:L, which conflicts with the description's explicit 'unauthenticated attackers' claim and should be verified.
RemediationAI
Vendor-released patch: upgrade the AllCoach plugin to version 1.0.2 or later, which adds the missing check that the submitted registration email is not already associated with an existing account. This is the primary and sufficient fix; apply it immediately on all sites running AllCoach. If you cannot patch right away, deactivate and remove the AllCoach plugin (this disables the vulnerable registration endpoint entirely but also removes AllCoach functionality from the site), or restrict or disable public access to the plugin's account-registration endpoint at the web-server/WAF layer - trade-off: this may break legitimate new-user self-registration. As an interim detection/containment control, audit wp_users and recent password-change/login events for unexpected admin credential changes and force-reset administrator passwords plus invalidate active sessions, since a prior compromise would not be undone by upgrading. Reference the WPScan advisory (https://wpscan.com/vulnerability/194e35d8-08ca-402d-a9bb-52383bc3dfab/) for authoritative fix confirmation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is AllCoach, a third-party WordPress plugin that exposes its own public account-registration endpoint rather than relying solely on WordPress core registration. The root cause is a missing uniqueness/ownership check: during registration the plugin accepts an arbitrary email address and, when that email already belongs to a registered user, updates (overwrites) the stored password hash for the matching wp_users record instead of rejecting the request or requiring proof of email ownership. No CWE was assigned in the source data, but the behavior maps to CWE-640 (Weak Password Recovery / improper account-identity verification) and CWE-620 (Unverified Password Change). Because WordPress stores all roles in the same users table, the flaw applies equally to subscriber and administrator accounts. The CPE 'cpe:2.3:a:unknown:allcoach:*:*:*:*:*:*:*:*' reflects that the vendor namespace is not yet formally catalogued.
Know when Allcoach gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated exploitation via a public endpoint with no user interaction (PR:N/UI:N/AC:L), and account takeover yields full C/I/A impact; PR:N chosen over the input's PR:L per the description.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.
Articles & Coverage 1
Executive ViewAI
The AllCoach WordPress plugin before version 1.0.2 enables account takeover of any user, including site administrators, through an unrestricted registration endpoint. Organizations using this plugin face direct risk of unauthorized administrative access and data compromise. Patching to version 1.0.2 is urgent and must be prioritized within 24 hours.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB