CVE-2026-18200

The CVE covers the FoodBoxBooker WordPress plugin before 1.0.8, where the application does not verify that the user account being updated belongs to the requesting user. This allows authenticated users with Subscriber-level access and above to modify the profile details of arbitrary users, includ...