The FoodBoxBooker WordPress plugin versions prior to 1.0.7 contain an improper privilege management vulnerability (CWE-269) that fails to properly validate password reset requests. This allows unauthenticated attackers to reset passwords for any user account, including those with administrative privileges, potentially resulting in complete control over the affected WordPress site. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and full confidentiality, integrity, and availability impact. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation enables an unauthenticated attacker to reset passwords for arbitrary users, including administrators, leading to a full site compromise. This compromises confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the password reset functionality if possible and monitor for suspicious password reset activity. Avoid using affected versions in production environments.