The AllCoach WordPress plugin before version 1.0.2 fails to verify that an email address submitted to a public account‑registration endpoint is not already associated with an existing user before overwriting that user’s password. This represents a CWE‑287 Authentication Failure and CWE‑613 Missing Authentication for Critical Operations weakness, allowing attackers to reset the password for any account with a known email and take control of the site.

WordPress sites that use the AllCoach plugin version earlier than 1.0.2 are affected. All users whose email addresses are registered on those sites are at risk, regardless of role, including administrators.

The vulnerability carries a high CVSS score of 8.8, indicating significant impact if exploited. However, the EPSS score is reported as less than 1 %, suggesting that exploitation is currently considered unlikely, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that without any authentication, provided they know an attack vector is that attackers either know or can discover such addresses and then trigger the password reset, allowing them to gain the privileges of the compromised account.