Foodboxbooker
Monthly
Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.
Insecure Direct Object Reference (IDOR) in the FoodBoxBooker WordPress plugin before 1.0.8 allows any authenticated user - including those with only Subscriber-level access - to overwrite the profile details of any other account on the site, including administrator accounts. The plugin fails to verify that the account being modified belongs to the requesting user, enabling horizontal and vertical privilege abuse without any special configuration. A publicly available proof-of-concept exists; exploitation is not confirmed in CISA KEV but the low barrier to entry makes this a practical account-takeover risk on any affected WordPress site.
Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.
Insecure Direct Object Reference (IDOR) in the FoodBoxBooker WordPress plugin before 1.0.8 allows any authenticated user - including those with only Subscriber-level access - to overwrite the profile details of any other account on the site, including administrator accounts. The plugin fails to verify that the account being modified belongs to the requesting user, enabling horizontal and vertical privilege abuse without any special configuration. A publicly available proof-of-concept exists; exploitation is not confirmed in CISA KEV but the low barrier to entry makes this a practical account-takeover risk on any affected WordPress site.