CVE-2026-18200 Overview
CVE-2026-18200 affects the FoodBoxBooker WordPress plugin in versions prior to 1.0.8. The plugin fails to verify that the user account being updated belongs to the requester. Authenticated users with Subscriber-level access or higher can modify profile details of arbitrary users, including administrators. This flaw represents an Insecure Direct Object Reference [CWE-639] and enables horizontal and vertical privilege escalation paths through profile manipulation.
Critical Impact
Authenticated Subscriber-level attackers can modify administrator profile details, potentially altering account information used for authentication or recovery workflows.
Affected Products
- FoodBoxBooker WordPress plugin versions before 1.0.8
Discovery Timeline
- 2026-08-10 - CVE-2026-18200 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-18200
Vulnerability Analysis
The FoodBoxBooker plugin exposes an account update endpoint accessible to any authenticated user. The endpoint accepts a target user identifier without confirming that identifier matches the current session's user. An attacker with Subscriber privileges can supply an arbitrary user ID and overwrite that account's profile fields.
The vulnerability is classified under [CWE-639]: Authorization Bypass Through User-Controlled Key. The plugin trusts the client-supplied user reference rather than deriving it from the authenticated session. This design pattern enables Insecure Direct Object Reference attacks against any registered user.
Profile modifications can extend to fields consumed by other WordPress workflows, including email addresses used for password reset delivery. An attacker who alters an administrator's email address can then trigger a password reset and hijack the account.
Root Cause
The plugin's update handler omits an ownership check between the authenticated user and the target user ID. Standard WordPress capability checks such as current_user_can( 'edit_user', $user_id ) are not enforced before profile fields are written to the database.
Attack Vector
Exploitation requires network access and valid credentials at the Subscriber role or above. The attacker sends a crafted request to the plugin's profile update endpoint with a target user ID belonging to another account. No user interaction from the victim is required. Refer to the WPScan Vulnerability Advisory for endpoint specifics.
Detection Methods for CVE-2026-18200
Indicators of Compromise
- Unexpected changes to administrator email addresses, display names, or profile metadata in wp_users and wp_usermeta tables.
- Password reset requests initiated shortly after profile update requests from low-privilege accounts.
- HTTP requests to FoodBoxBooker plugin update endpoints originating from Subscriber-level sessions targeting other user IDs.
Detection Strategies
- Correlate WordPress audit logs to flag profile updates where the acting user ID differs from the target user ID.
- Alert on any profile modification affecting an account with the administrator role performed by a non-administrator session.
- Baseline normal FoodBoxBooker request patterns and flag deviations in user ID parameters.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture user meta changes with acting user attribution.
- Forward WordPress and web server logs to a centralized analytics platform for cross-user correlation.
- Monitor outbound password reset emails and cross-reference them against recent profile update events.
How to Mitigate CVE-2026-18200
Immediate Actions Required
- Update the FoodBoxBooker plugin to version 1.0.8 or later on all WordPress installations.
- Audit all administrator accounts for unauthorized changes to email addresses and profile fields.
- Force password resets for administrator accounts if tampering is suspected.
Patch Information
Upgrade FoodBoxBooker to version 1.0.8, which introduces the missing ownership verification on the account update path. Consult the WPScan Vulnerability Advisory for the fixed version reference.
Workarounds
- Deactivate the FoodBoxBooker plugin until the site can be upgraded to version 1.0.8.
- Restrict user registration to reduce the population of authenticated accounts that could exploit the flaw.
- Deploy a web application firewall rule to block requests to the plugin's update endpoint where the target user ID does not match the session user.
# Configuration example
wp plugin update foodboxbooker --version=1.0.8
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
