FoodBoxBooker CVE-2026-16298

No special conditions beyond having the vulnerable plugin present - remote unauthenticated exploitation against default configurations of any WordPress site running FoodBoxBooker prior to 1.0.7 (CVSS AV:N/AC:L/PR:N/UI:N). The exploit exercises the plugin's password-reset request handling, so the plugin must be installed and active. The principal limiting factor is prevalence: the target must actually run this specific, low-footprint plugin at a version below 1.0.7; no valid session, token, or user interaction is required.

The signals are mixed but lean toward high priority for any site that actually runs this plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) describes a trivially reachable, unauthenticated, no-interaction network attack with total impact, and a public exploit exists - so exploitability is proven, not theoretical. Countervailing that, EPSS is only 0.15% (4th percentile) and the CVE is not in CISA KEV, which reflects the plugin's small deployment footprint rather than any difficulty of exploitation; this reads as a targeted-opportunity bug rather than an internet-wide worming event. Given a working exploit against default configurations, any operator running FoodBoxBooker below 1.0.7 should treat patching as urgent regardless of the low EPSS, since the low probability reflects rarity of the product, not safety of the flaw.

An attacker locates a WordPress site running FoodBoxBooker below 1.0.7 and sends a crafted password-reset request targeting the known 'admin' account, exploiting the missing validation to set a password of their choosing without any authentication or user interaction. They log in as administrator and install a malicious plugin or PHP webshell to take over the site. Public exploit code lowers the skill required to a copy-paste level.