AllCoach – Coaching Management & Scheduling

AllCoach – Coaching Management & Scheduling has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 7.3, and the most serious one scores 7.3 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Improper Privilege Management, behind 1 of the records (100%).

The one issue recorded for AllCoach – Coaching Management & Scheduling has a vendor fix available, so running the current release closes it.

All of these findings were reported by Pedro Pinho. AllCoach – Coaching Management & Scheduling is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSHigh
7.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all AllCoach – Coaching Management & Scheduling vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.3CVE-2026-10830

AllCoach <= 1.0.1 - Privilege Escalation to Unauthenticated Account Takeover

Read the full analysis

Vulnerability Records

1 records
AllCoach – Coaching Management & Scheduling banner
Latestv1.1.1

AllCoach – Coaching Management & Scheduling

ThemeGrill

Author

ThemeGrill

0.0(0)
0/100
Last Updated
2026-08-05 (17d ago)
Active Installs
100+
Downloads
1,583
Requires WP
6.5+
Requires PHP
8.2+
Tested up to
WP 6.9.7
Created
2026-05-05 (4mo ago)

Run Your Coaching Business from WordPress AllCoach is a complete coaching business management plugin for WordPress. Sell coaching programs, take payments with PayPal, deliver interactive client activities, schedule one-on-one sessions, and send automated notifications — all from a single dashboard. Whether you are a personal trainer, life coach, nutritionist, business coach, or tutor, AllCoach gives you everything you need to run your practice without stitching together separate tools. Why Choose AllCoach? Everything in One Place: Programs, clients, sessions, orders, and notifications are all managed from your WordPress admin. No extra subscriptions or integrations needed. Interactive Client Activities: Deliver structured worksheets and assignments to clients. Clients submit responses directly from their portal and you review them from the admin dashboard. Client-Friendly Portal: Clients can access their programs, activities, sessions, meeting links, and profile from a dedicated frontend account area. Google Meet Integration: Connect your Google account once and meeting links can be generated automatically for sessions — no manual copy-pasting. PayPal & Manual Payments: Sell paid programs through PayPal — cards included — or confirm offline payments by hand. Free programs are confirmed automatically at checkout. Know Your Numbers: A built-in analytics dashboard shows how your programs, clients, orders, and bookings are performing over time. Privacy Ready: Collect privacy policy consent at checkout, and let clients’ data flow through WordPress’ own personal data export and erase tools. Who is AllCoach for? Personal Trainers — Sell training programs, deliver workout plans as activities, and schedule one-on-one sessions with automated reminders. Life Coaches — Manage client enrollments, assign reflection exercises, and meet clients via Google Meet. Nutritionists — Deliver structured nutrition programs with interactive check-ins and track client responses. Business Coaches — Sell paid programs, assign worksheets, confirm payments manually, and track client progress. Tutors & Educators — Organize content into programs with sections and activities, manage session bookings, and stay on top of client submissions. AllCoach Features Coaching Programs Create and publish coaching programs with flexible pricing — paid or free Organize programs into sections for a structured delivery path Add interactive activities to each section Set enrollment limits or leave them unlimited Assign programs to categories for easy filtering and discovery Share a unique buy URL for direct enrollment Client Activities Build activities with rich content and interactive form fields Supported field types: short answer, long answer, multiple choice, checkboxes, and date Clients complete and submit activities directly from their account portal Track completion status for every client per activity Review all client responses from the admin dashboard Reuse activities across programs with the activity library Client Management Maintain a full client directory with enrollment history and session notes Track activity completion and session progress per client View all orders, sessions, and activity responses from a single client profile Guest checkout — new clients enroll with just their name and email, account created automatically Session Booking Clients book one-on-one sessions directly from their account portal Session statuses: scheduled, completed, cancelled, no-show Full session history logged per client Timezone-aware booking with client timezone support Coach Availability Define your weekly available days and time slots Bookings are automatically validated against your availability Double-booking prevented — for both you and your clients Meeting Types Google Meet — connect your Google account and let AllCoach generate the link Custom URL — bring your own Zoom, Teams, or Whereby link Face to face — set a physical location for in-person sessions Meeting details are included in confirmation and reminder emails Google Meet Integration Connect your Google account via OAuth from the Settings page Google Calendar events created automatically for every session Meeting links generated automatically and stored with each booking Meeting URL included in confirmation and reminder emails via the {meeting_url} placeholder PayPal Payments Accept PayPal and card payments for paid programs Order status stays in sync with PayPal through void, decline, and refund webhooks Abandoned checkout orders are cleaned up automatically Enrollment and session booking are gated until the order is actually paid Order & Payment Management Orders move through pending, confirmed, and cancelled statuses Confirm PayPal payments automatically, or confirm offline payments manually with an optional transaction reference Reactivate cancelled orders — set back to pending or directly to confirmed Bulk status actions for faster order management Free programs are confirmed automatically at checkout Analytics Dashboard overview of programs, clients, orders, and bookings Track revenue and enrollment trends over time Choose which metrics you want to see Add-ons Dedicated Add-ons page to see and enable available add-ons Turn individual features on or off per site Discover optional add-ons that extend AllCoach further Privacy & GDPR Ask clients to accept your privacy policy at checkout, with consent recorded Orders, enrollments, bookings, and consent records are included in WordPress’ personal data export The same data is removed when you run WordPress’ personal data erase request Styling Set your primary color and button color from the Styling settings tab Client-facing pages pick up your palette automatically Client Account Portal Dedicated frontend dashboard for every client — no WordPress admin access required Dashboard — overview of enrolled programs and upcoming sessions Programs — browse and access all enrolled programs and their content Activities — view and complete assigned activities, submit responses Appointments — view upcoming sessions, book new sessions, join Google Meet Profile — update personal details and change password Forgot password — clients can request a reset link and set a new password without leaving the portal Use of 3rd Party Services To provide certain features, AllCoach connects to the following external services when those features are enabled. No data is sent to these services unless the corresponding feature is explicitly configured and activated by the site administrator. Google APIs — Used for Google Calendar and Google Meet integration. When a coach connects their Google account, AllCoach uses the Google OAuth 2.0 service to authenticate, the Google Calendar API to create and manage session events, and the Google Meet API to generate video call links. The coach’s access token and refresh token are stored on your WordPress site. Client email addresses are shared with Google Calendar only when adding them as event attendees. Service endpoints: accounts.google.com, oauth2.googleapis.com, www.googleapis.com Google Terms of Service | Google Privacy Policy PayPal — Used to accept PayPal and card payments. When the PayPal gateway is configured and a client pays for a program, AllCoach sends the order amount, currency, program title, and the client’s name and email address to PayPal in order to create and capture the payment. PayPal returns a transaction reference that is stored with the order, and sends webhook notifications back to your site so the order status stays correct when a payment is voided, declined, or refunded. Card details are entered on PayPal’s own hosted fields and are never received or stored by AllCoach or your WordPress site. Service endpoints: api-m.paypal.com (live), api-m.sandbox.paypal.com (sandbox), www.paypal.com PayPal Terms of Service | PayPal Privacy Policy Each of these services is only contacted when the corresponding feature is enabled and configured by the site administrator. AllCoach does not transmit personal data to any external service beyond what is described above.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C