AllCoach Plugin Password Reset Without Email Verification

The AllCoach WordPress plugin before version 1.0.2 contains a critical authentication bypass vulnerability in its public account-registration endpoint. The flaw stems from insufficient input validation: the plugin fails to verify whether an email address submitted during registration is already associated with an existing user account before overwriting that user's password. This allows unauthenticated attackers to reset passwords for any account, including administrator accounts, by simply submitting an existing user's email address through the registration form. For WordPress site owners using this plugin, the impact is severe—attackers can gain complete administrative control of the site without requiring any prior authentication or knowledge of existing passwords.

While this specific CVE currently maps to zero Casky skills due to the absence of detailed MITRE ATT&CK technique assignments, practitioners using Casky's Claude AI-powered platform with extended reasoning would detect the attack patterns underlying this vulnerability through behavioral analysis of account-related activities. The core attack chain involves T1078 (Valid Accounts) exploitation, where attackers leverage the registration endpoint to manipulate account credentials. Security teams monitoring their WordPress instances with Casky's 754 mapped skills would identify suspicious patterns such as: unexpected password reset requests from unfamiliar IP addresses, registration attempts targeting high-privilege accounts, and subsequent administrative actions immediately following registration activity. By correlating these signals with Casky's threat modeling capabilities, practitioners would recognize the hallmarks of unauthorized account takeover before full compromise occurs, enabling rapid incident response and remediation.