CVE-2026-10830
AllCoach < 1.0.2 - Unauthenticated Account Takeover
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS 8.8EPSS 0.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
06 Jul 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · AllCoachpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/194e35d8-08ca-402d-a9bb-52383bc3dfab/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.