CVE-2026-106002

MediumCVSS 5.3

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Court Reservation WordPress plugin before 1.12.4 does not perform authorization or nonce verification on one of its challenge-management actions. This allows unauthenticated users to delete arbitrary tournament-ladder challenge records along with the linked court-booking event.

Risk Assessment

An unauthenticated attacker can delete tournament data and linked bookings, leading to data loss and schedule disruption.

Recommendation

Update the Court Reservation plugin to version 1.12.4 or later.

Other vulnerabilities in Court Reservation WordPress plugin

CVE-2026-106003Medium
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions. This allows unauthenticated users to add or delete reservation types in the plugin's configuration.

Original NVD description (English source)

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS