CVE-2026-10830: AllCoach WordPress Auth Bypass Flaw

CVE-2026-10830 Overview

CVE-2026-10830 affects the AllCoach WordPress plugin versions prior to 1.0.2. The plugin exposes a public account-registration endpoint that fails to verify whether a submitted email address is already tied to an existing user. Attackers can submit an administrator's email to this endpoint and overwrite the associated password without authentication. This flaw enables full account takeover of any user, including administrators, leading to complete site compromise. The vulnerability is a broken access control and authentication bypass issue [CWE-287, CWE-640] affecting the password reset workflow.

Critical Impact
Unauthenticated attackers can reset arbitrary account passwords, including administrator accounts, and take over the entire WordPress site.

Affected Products

AllCoach WordPress plugin versions before 1.0.2
WordPress sites with the vulnerable plugin activated
Administrator accounts managed by the affected plugin

Discovery Timeline

2026-07-06 - CVE-2026-10830 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-10830

Vulnerability Analysis

The AllCoach plugin exposes a registration endpoint accessible without authentication. When a user submits registration data, the endpoint accepts an email address and a new password. The plugin then writes the provided password to the account matching that email address. Because the endpoint does not check whether the email is already associated with an existing account, submitting a known administrator email causes the plugin to overwrite that administrator's password. The attacker then authenticates using the newly set credentials and gains administrative control of the site.

Root Cause

The root cause is missing validation in the account creation logic. The plugin treats the registration endpoint as an account creation path but writes to existing records when the email matches. No check verifies whether an account already exists for the submitted email before performing a password write. This is a business logic flaw combined with broken authentication in the password-handling workflow.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker enumerates or guesses an administrator's email address, then submits a crafted request to the public registration endpoint with that email and an attacker-chosen password. The plugin overwrites the administrator's stored password. The attacker then logs in through the standard wp-login.php interface using the new credentials. No user interaction and no prior authentication are required.

Refer to the WPScan Vulnerability Report for technical details on the vulnerable code path.

Detection Methods for CVE-2026-10830

Indicators of Compromise

Unexpected password reset events or successful logins to administrator accounts from unfamiliar IP addresses
POST requests to the AllCoach plugin's registration endpoint referencing administrator email addresses
New administrator sessions established shortly after requests to the registration endpoint
WordPress audit log entries showing password changes without a corresponding user-initiated reset flow

Detection Strategies

Inspect web server access logs for POST requests to AllCoach registration endpoints originating from external IP addresses
Correlate password change events with administrator login events occurring in the same session window
Deploy WordPress audit plugins that log every password change, including the source IP and request path
Alert on any administrator authentication event that follows a non-standard password reset workflow

Monitoring Recommendations

Monitor the wp_users table for user_pass field updates outside expected reset flows
Track authentication events for privileged accounts and flag logins from previously unseen geolocations
Enable file integrity monitoring on wp-content/plugins/allcoach/ to detect tampering or version changes
Ingest WordPress and web server logs into a centralized SIEM for correlation and retention

How to Mitigate CVE-2026-10830

Immediate Actions Required

Update the AllCoach plugin to version 1.0.2 or later on all affected WordPress installations
Force password resets for all administrator and privileged user accounts on affected sites
Review recent administrator login activity and revoke any suspicious active sessions
Audit the wp_users table and user role assignments for unauthorized changes

Patch Information

The vendor released version 1.0.2 of the AllCoach plugin, which adds validation to prevent overwriting passwords of existing users through the registration endpoint. Administrators should apply the update immediately through the WordPress plugin manager. See the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Deactivate and remove the AllCoach plugin until the patched version can be deployed
Restrict access to the plugin's registration endpoint at the web server or WAF layer
Enforce multi-factor authentication for all administrator accounts to limit the impact of password overwrites
Rename or restrict access to wp-login.php to reduce exposure of takeover attempts

bash

# Block access to the AllCoach registration endpoint via .htaccess as a temporary mitigation
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} ^/wp-json/allcoach/.*/register [NC]
  RewriteRule .* - [F,L]
</IfModule>