EUVD-2026-54996

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators...

CVE-2026-18200

The CVE covers the FoodBoxBooker WordPress plugin before 1.0.8, where the application does not verify that the user account being updated belongs to the requesting user. This allows authenticated users with Subscriber-level access and above to modify the profile details of arbitrary users, includ...

EUVD-2026-55036

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2026-16298

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...

CVE-2026-16298

The FoodBoxBooker WordPress plugin is affected: versions prior to 1.0.7 do not properly validate password reset requests, allowing unauthenticated actors to reset arbitrary user passwords (including administrators), potentially taking full site control. Root cause: insufficient validation of pass...