Allcoach
Monthly
Account takeover in the AllCoach WordPress plugin before 1.0.2 lets remote attackers overwrite the password of any existing account - including administrators - by re-submitting that account's email address to the public account-registration endpoint, which fails to check whether the email is already tied to a user before writing a new password. Publicly available exploit code exists and a vendor patch (1.0.2) has been released, but there is no public exploit identified as actively exploited in the wild; EPSS is low (0.14%, 4th percentile) and CISA SSVC rates exploitation as 'none' despite a 'total' technical impact. The provided CVSS vector lists PR:L, which conflicts with the description's explicit 'unauthenticated attackers' claim and should be verified.
Account takeover in the AllCoach WordPress plugin before 1.0.2 lets remote attackers overwrite the password of any existing account - including administrators - by re-submitting that account's email address to the public account-registration endpoint, which fails to check whether the email is already tied to a user before writing a new password. Publicly available exploit code exists and a vendor patch (1.0.2) has been released, but there is no public exploit identified as actively exploited in the wild; EPSS is low (0.14%, 4th percentile) and CISA SSVC rates exploitation as 'none' despite a 'total' technical impact. The provided CVSS vector lists PR:L, which conflicts with the description's explicit 'unauthenticated attackers' claim and should be verified.