FoodBoxBooker CVE-2026-18200

Exploitation requires the attacker to hold a valid authenticated session on the WordPress site at Subscriber level or above - the minimum WordPress role, typically acquired through self-registration or the plugin's booking workflow. No special server configuration, non-default plugin settings, or elevated privileges are needed beyond this minimum authentication. Exploitation is limited by the need for a valid session (unauthenticated visitors cannot exploit this); however, on WordPress sites that allow open user registration (the WordPress default), obtaining a Subscriber account is trivial and imposes no meaningful barrier. The attack is constrained to sites running the FoodBoxBooker plugin at a version below 1.0.8.

The official CVSS score of 4.3 (Medium) reflects network reachability and low-privilege requirement but caps integrity impact at Low and records no confidentiality or availability impact, which understates the practical risk. The ability to modify an administrator's email or credentials constitutes a de facto account takeover path, which is a high-severity outcome not fully captured by the S:U/I:L metrics. EPSS sits at 0.13% (3rd percentile), indicating that automated exploitation has not yet been observed at scale, consistent with the niche deployment footprint of this plugin. However, a publicly available PoC from WPScan lowers the attacker skill threshold significantly, meaning even opportunistic actors can exploit this. The vulnerability is not listed in CISA KEV, so confirmed active exploitation cannot be asserted. Taken together, the raw CVSS score likely underrepresents real-world account-takeover risk for any WordPress site where subscribers can self-register, and administrators of such sites should treat patching as a priority rather than deferring based on the 4.3 score alone.

An attacker registers a free Subscriber account on a WordPress site running FoodBoxBooker before 1.0.8 - a typical step in the plugin's booking flow - then sends a crafted profile-update request substituting an administrator's user ID for their own. The administrator's email address is changed to one the attacker controls, after which standard WordPress password-reset flow grants full administrative access to the site. A public PoC from WPScan demonstrates this technique.