Executive brief
FoodBoxBooker is a WordPress plugin that provides user account management and booking functionality. A vulnerability in versions before 1.0.8 allows any authenticated user with basic subscriber-level permissions to modify profile details of any other user on the site, including administrators. An attacker could change administrative account names, email addresses, and other profile information to disrupt operations or facilitate further compromise.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the plugin's user profile update functionality. The vulnerable AJAX action "account_edit_formsubmit" accepts a user ID parameter (fbbttm-userid) but fails to verify that the authenticated user owns the account being modified. An attacker with Subscriber-level access can craft a request to the wp-admin/admin-ajax.php endpoint, providing arbitrary user IDs and profile data, and successfully modify any user's profile (first name, last name, email) without authorization. The vulnerability requires authentication and CSRF nonce values, which are available on the public "My Account" page auto-created by the plugin. The issue is fixed in version 1.0.8 and later.
Affected products
- FoodBoxBooker FoodBoxBooker before 1.0.8
Timeline
- 2026-08-07: disclosed
- 2026-08-08: patched: Fixed in version 1.0.8