CVE-2026-10830 is an improper privilege management vulnerability (CWE-269) in the AllCoach WordPress plugin prior to version 1.0.2. The plugin fails to verify whether an email address submitted to a public account-registration endpoint is already linked to an existing user before overwriting that user's password. This allows unauthenticated attackers to reset passwords of arbitrary accounts, including administrator accounts, leading to full site takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.

An attacker can reset the password of any user account, including administrators, without authentication. This leads to complete compromise of the affected WordPress site, allowing unauthorized access, data theft, site defacement, or further malicious activities. The vulnerability severely impacts confidentiality, integrity, and availability of the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the account registration endpoint if possible and monitor for suspicious activity related to password resets. Avoid using affected versions in production environments.