CVE-2026-16298

CVE-2026-16298 is a critical unauthenticated password reset vulnerability in the FoodBoxBooker WordPress plugin, patched in version 1.0.7. The CVSS 9.8 is earned: this is an authentication bypass that requires no prior access, allows targeting any user account, and grants immediate full admin-level compromise with no post-exploitation pivot needed. The vulnerability lives in the password reset handler, which fails to validate that the requestor has any legitimate relationship to the target account. WordPress admin access through this plugin means file system write access via the theme editor, ability to install malicious plugins, modify .htaccess for persistence, and extract database credentials including any OAuth tokens or payment integrations connected to the booking system. This isn't privilege escalation—it's direct unauthenticated root-level compromise. What makes this exploitable in practice is the plugin's domain. Booking systems collect customer email addresses as part of normal operation, which collapses the traditional separation between the vulnerability surface and user enumeration. An attacker doesn't need a separate user enumeration bug—the booking form itself provides the target list. If the plugin exposes user identifiers through any public-facing interface, exploitation becomes trivial. Check your installed version immediately. If you're running any version before 1.0.7, treat this as an active emergency. The patching window in WordPress ecosystems typically runs 60-120 days from CVE publication to 80% saturation across active installs—that's 2-4 months where every unpatched instance is simultaneously targetable by anyone with the CVE number. A 9.8 with no authentication requirement means the barrier to exploitation post-disclosure is effectively zero; script-level automation can mass-target remaining vulnerable instances. Beyond updating, audit whether the plugin exposes any user identifiers (usernames, emails) in public responses. Review any deprecated reset handlers that may still exist in the codebase—if the vendor replaced one reset endpoint with another, the old handler may remain active even if nominally deprecated. The fix history alone tells you this plugin iterated through multiple versions before addressing authentication—this pattern suggests the auth surface accumulated faster than it was audited, and other hidden gaps may exist. The broader lesson: password reset logic in WordPress plugins is consistently the highest-risk authentication surface because plugin developers treat it as infrastructure boilerplate rather than a security-critical code path. The WordPress hooks system creates false confidence that the framework handles auth securely, but each plugin must correctly implement the validation itself. This vulnerability is structurally identical to bugs we've seen in membership, e-commerce, and social plugins for over a decade—the pattern hasn't changed, only the blast radius has, as these plugins increasingly serve as hubs connecting payment processors, CRM systems, and franchise-level integrations.

Reviewed through automated stages and approved by a human before publication.