CVE-2026-10830: AllCoach WordPress Plugin Privilege Escalation via Password Reset

Technical summary

CVE-2026-10830 stems from inadequate input validation in the AllCoach plugin's public account-registration endpoint. The vulnerability arises from the absence of a pre-registration check to determine whether the supplied email address already belongs to an existing user account. When the registration process receives an email that matches a current user, the plugin proceeds to overwrite the associated password rather than rejecting the request or prompting additional verification. The lack of authentication requirement on this endpoint means any unauthenticated actor can initiate password resets for arbitrary accounts. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability due to the potential for administrative account takeover.

Business impact

Successful exploitation enables attackers to seize control of WordPress sites running the vulnerable AllCoach plugin. Immediate risks include unauthorized access to sensitive data, malware injection, content manipulation, user data theft, and reputational damage. If an administrator account is compromised, the attacker gains full site control, including the ability to install backdoors, modify security settings, and exfiltrate customer or business information. Organizations relying on this plugin should treat exploitation as a critical incident with potential legal and compliance implications depending on stored data sensitivity.

Affected systems

WordPress installations using the AllCoach plugin in versions prior to 1.0.2 are vulnerable. The affected component is the public-facing account registration endpoint, which is typically accessible without authentication. Any WordPress environment with this plugin enabled faces immediate risk, regardless of other security controls, because the vulnerability bypasses standard WordPress authentication mechanisms.

Exploitability

Exploitation requires only network access to the vulnerable registration endpoint—no credentials, special privileges, or complex attack chains are necessary. An attacker can submit a simple HTTP request with any existing user's email address to trigger an unauthorized password reset. The attack is straightforward, reliable, and leaves minimal forensic traces if logging is not explicitly enabled. The lack of rate-limiting or CAPTCHA protections on typical WordPress registration forms further reduces barriers to abuse. Public WordPress security research suggests this class of vulnerability is actively researched and frequently weaponized once disclosed.

Remediation

Immediately update the AllCoach plugin to version 1.0.2 or later, which includes a fix that validates email uniqueness before processing password resets on the registration endpoint. Administrators should verify the update has been applied and confirm that no unauthorized password resets occurred during the exposure window. Organizations unable to update immediately should disable the AllCoach plugin or restrict access to the registration endpoint through firewall or Web Application Firewall (WAF) rules until patching is feasible.

Patch guidance

Obtain the latest version of AllCoach (1.0.2 or newer) directly from the official WordPress plugin repository or the vendor's website. Before applying, back up your WordPress database and files. Update through the WordPress admin dashboard (Plugins → Installed Plugins → Update) or via WP-CLI using `wp plugin update allcoach`. After updating, verify that password reset functionality works as expected for legitimate users and that the vulnerability is resolved by checking plugin version and consulting the vendor's security advisory for any additional post-patch steps.

Detection guidance

Review WordPress access and error logs for unusual registration endpoint requests, particularly those using existing admin email addresses. Monitor for unexpected password reset activities or successful logins from unfamiliar IP addresses shortly after the plugin was installed. Enable WordPress logging via `WP_DEBUG_LOG` to capture plugin-level activity. In WAF logs, look for POST requests to registration forms with high-entropy payloads or automated patterns. Query user account modification timestamps to identify any suspicious password changes coinciding with the vulnerability window. Consider scanning for installed plugin versions using WordPress security scanners that report plugin version information.

Why prioritize this

This vulnerability merits immediate patching due to its high CVSS score (8.8), ease of exploitation (no authentication required, simple network request), and severe impact (complete site takeover via admin account compromise). The attack requires no special tools or knowledge, making it likely to be exploited once publicly disclosed. WordPress sites are frequent targets for automated attacks, and this flaw provides a direct path to administrative access. Organizations should treat this as a critical priority regardless of current KEV status.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the vulnerability's network-accessible attack vector, low complexity, lack of privilege requirement, and high impact on confidentiality (full data access), integrity (malware injection, content modification), and availability (site disruption). The severity is elevated because the flaw directly enables account takeover of the highest-privilege user role in WordPress, from which all other protections can be circumvented. While the attack requires an unauthenticated actor to interact with the plugin, the barrier is negligible in practice.

Frequently asked questions