PatchSiren

FoodBoxBooker CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review FoodBoxBooker CVE published 2026-08-10

CVE-2026-16298

The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover. This vulnerability has significant implications for WordPress site administrators and users of the FoodBoxBooker plugin. Affected users should verify their plug [truncated]