Unauthenticated Password Reset in AllCoach WordPress Plugin

Executive Summary

The CVE-2026-10830 vulnerability affects the AllCoach WordPress plugin versions below 1.0.2. It allows unauthenticated attackers to take over arbitrary user accounts, including administrators, by exploiting a flaw in the account-registration process.

The issue occurs because the plugin does not verify if an email address submitted to a public registration endpoint is already linked to an existing user before resetting the user's password. This enables attackers to overwrite passwords and gain full control of the affected site.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to reset passwords of arbitrary accounts, including administrators, and take over the site. This unauthorized access can lead to exposure or manipulation of sensitive personal data stored on the site.

Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal data and secure access controls.

Therefore, failure to patch this vulnerability could result in violations of these regulations due to improper privilege management and broken authentication.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the AllCoach WordPress plugin versions below 1.0.2 and involves an unauthenticated password reset via a public account-registration endpoint. Detection involves checking if your WordPress site is running the vulnerable plugin version.

To detect if the vulnerable plugin is installed and its version, you can use the following command on the server hosting the WordPress site:

• grep -i 'allcoach' wp-content/plugins/allcoach/readme.txt
• Or check the plugin version via WP-CLI:
• wp plugin get allcoach --field=version

Additionally, to detect attempts to exploit this vulnerability on your network, you can monitor HTTP POST requests to the account-registration endpoint that include email addresses already associated with existing users. For example, using a network monitoring tool or web server logs, look for suspicious password reset requests.

Since the vulnerability involves unauthenticated password resets, monitoring for unusual password reset activity or multiple password reset requests for the same email address could indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a critical impact as it allows unauthenticated attackers to reset the passwords of arbitrary accounts, including administrator accounts.

By exploiting this flaw, attackers can take over the site, gaining full control over user accounts and potentially the entire WordPress installation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-10830 vulnerability in the AllCoach WordPress plugin, users should update the plugin to version 1.0.2 or later.

This update fixes the issue where the plugin did not verify if an email address submitted to the public account-registration endpoint was already associated with an existing user before resetting the password, preventing unauthenticated attackers from taking over accounts.

Useful 0 Not Useful 0