What is the CVSS score of CVE-2026-16298?

CVE-2026-16298 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of FoodBoxBooker are affected by CVE-2026-16298?

The FoodBoxBooker WordPress plugin contains a critical vulnerability enabling unauthenticated attackers to reset administrator passwords and gain complete control of affected websites.. A patch is available.

Is there a public PoC exploit available for CVE-2026-16298?

Yes, a public proof-of-concept exploit is available for CVE-2026-16298. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-16298?

Within 24 hours, identify all WordPress installations running FoodBoxBooker versions before 1.0.7 and immediately apply the vendor-released patch (version 1.0.7) or disable the plugin pending remediation. Within 7 days, reset all administrator passwords, review authentication logs for unauthorized login attempts between vulnerability discovery and patch deployment, and verify successful plugin updates across all affected instances. Within 30 days, conduct a post-incident security audit including database integrity verification, user account review for unauthorized administrative actions, and forensic assessment of access logs to identify potential data exfiltration during the exposure window.

FoodBoxBooker CVE-2026-16298

EUVD-2026-55036 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-10 WPScan

GHSA-4w8m-c933-mrf8

WordPress Privilege Escalation Foodboxbooker Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network request with no interaction resets any account (PR:N/UI:N/AC:L); admin takeover yields total confidentiality, integrity, and availability impact within the WordPress instance (scope unchanged).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:28 vuln.today

CVSS changed

Aug 11, 2026 - 21:22 NVD

9.8 (CRITICAL)

Patch available

Aug 10, 2026 - 08:02 EUVD

CVE Published

Aug 10, 2026 - 06:00 cve.org

CRITICAL 9.8

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

AnalysisAI

Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.

Technical ContextAI

FoodBoxBooker is a WordPress plugin (food-box/meal booking functionality) that runs inside the WordPress PHP application stack and relies on WordPress's user and authentication model. The weakness is classified as CWE-269 (Improper Privilege Management): the plugin's custom password-reset workflow does not adequately verify that the requester is authorized to reset a given account, so the reset token/identity binding can be abused to target arbitrary accounts. Because WordPress administrator accounts can install plugins/themes and execute PHP, resetting an admin password converts an authentication-logic bug into full application compromise. The affected component is confined to the plugin, not WordPress core, per the CPE cpe:2.3:a:unknown:foodboxbooker:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: 1.0.7 - upgrade the FoodBoxBooker plugin to 1.0.7 or later immediately, as this is the primary and complete fix. If an in-place upgrade cannot be applied at once, deactivate and remove the plugin, which fully removes the vulnerable code path at the cost of losing booking functionality until an upgrade is scheduled. As interim compensating controls, restrict access to the plugin's password-reset/AJAX endpoints at the WAF or web-server layer and monitor for unexpected password-reset activity on administrator accounts; note that WAF rules are a stopgap that may be bypassed and do not substitute for the update. After patching, rotate credentials and review admin accounts for signs of prior takeover. Advisory and details: https://wpscan.com/vulnerability/d554361c-e6c7-4843-a9cc-005b08685a5b/ .