EUVD-2026-54996
GHSA-jchc-3px4-v985
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable IDOR with only Subscriber auth required; integrity impact raised to High because arbitrary admin profile modification enables site takeover.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators.
AnalysisAI
Insecure Direct Object Reference (IDOR) in the FoodBoxBooker WordPress plugin before 1.0.8 allows any authenticated user - including those with only Subscriber-level access - to overwrite the profile details of any other account on the site, including administrator accounts. The plugin fails to verify that the account being modified belongs to the requesting user, enabling horizontal and vertical privilege abuse without any special configuration. A publicly available proof-of-concept exists; exploitation is not confirmed in CISA KEV but the low barrier to entry makes this a practical account-takeover risk on any affected WordPress site.
Technical ContextAI
FoodBoxBooker is a WordPress plugin (CPE: cpe:2.3:a:unknown:foodboxbooker:*:*:*:*:*:*:*:*) likely used for food delivery or box subscription booking workflows. The flaw is classified as CWE-639: Authorization Bypass Through User-Controlled Key - a form of IDOR where the application accepts a user-supplied identifier (such as a user ID in a POST parameter or URL) to determine which account to update, without confirming that the authenticated requester owns or is authorized to modify that account. Because WordPress assigns all registered users at minimum the Subscriber role, any account registered on the site - including those created during a standard checkout or booking flow - can trigger this endpoint. Administrator profile data (email, password, display name) may be modifiable, which can facilitate full site takeover.
RemediationAI
Update the FoodBoxBooker plugin to version 1.0.8 or later, which is the vendor-released patched version. This update can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or manually by replacing the plugin files with those from the official WordPress plugin repository. If immediate patching is not possible, restrict user self-registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to eliminate the lowest-privilege attack path; note that this may break intended booking/subscription flows where guest users register during checkout. Additionally, audit recently modified administrator and editor accounts for unauthorized profile changes. References: WPScan advisory at https://wpscan.com/vulnerability/a5864653-4df6-4d8d-9f8a-ace7b0220342/ and VulDB entry at https://vuldb.com/vuln/387325.
More in Foodboxbooker
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today