PULSE
LIVE22signals / 24h
ES
FEED
ransomqilin reclama a Primeline Logistics · IE · Transportation/Logisticsransomqilin reclama a Recsa · CR · Not Foundransomqilin reclama a Salida Union School District · US · Educationransomchaos reclama a neopharmlabs.com · US · Healthcareransomqilin reclama a Cpcg · BR · Not Foundransomqilin reclama a EFU Life Assurance · PK · Financial Servicesransomqilin reclama a Infina Health · Healthcareransomm3rx reclama a ubfreight.com · Transportation/Logisticsransomkrybit reclama a dhli.in · IN · Not Foundransomkrybit reclama a Vibonum Technologies Private Limited · IN · Technologyransomakira reclama a Kruse Construction · Constructionransomakira reclama a University Sprinkler Systems · Business Servicesransombooba project reclama a Pelli Clarke Pelli Architects · US · Business Servicesransomdragonforce reclama a Koshkaryan Law Group · US · Business Servicesransomqilin reclama a Primeline Logistics · IE · Transportation/Logisticsransomqilin reclama a Recsa · CR · Not Foundransomqilin reclama a Salida Union School District · US · Educationransomchaos reclama a neopharmlabs.com · US · Healthcareransomqilin reclama a Cpcg · BR · Not Foundransomqilin reclama a EFU Life Assurance · PK · Financial Servicesransomqilin reclama a Infina Health · Healthcareransomm3rx reclama a ubfreight.com · Transportation/Logisticsransomkrybit reclama a dhli.in · IN · Not Foundransomkrybit reclama a Vibonum Technologies Private Limited · IN · Technologyransomakira reclama a Kruse Construction · Constructionransomakira reclama a University Sprinkler Systems · Business Servicesransombooba project reclama a Pelli Clarke Pelli Architects · US · Business Servicesransomdragonforce reclama a Koshkaryan Law Group · US · Business Services
← All CVEs
CVE WatchJul 6, 2026

CVE-2026-10830

The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not

CVSS

8.8

High

EPSS

0.3%

p17

KEV

—

Exploit Today

5

0-100

Published: Jul 6, 2026 · Last modified: Jul 6, 2026

EPSS · 30d
0.1%EPSS · 30 days0.3%
2026-07-062026-07-21
Technical description

The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.

Official references
Related CVEs

No related CVEs by CWE or product.