CVE-2026-106003

MediumCVSS 5.3

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions. This allows unauthenticated users to add or delete reservation types in the plugin's configuration.

Risk Assessment

An unauthenticated attacker can modify the reservation configuration, potentially disrupting the booking system or causing loss of configuration data.

Recommendation

Update the Court Reservation plugin to version 1.12.4 or later.

Other vulnerabilities in Court Reservation WordPress plugin

CVE-2026-106002Medium
The Court Reservation WordPress plugin before 1.12.4 does not perform authorization or nonce verification on one of its challenge-management actions. This allows unauthenticated users to delete arbitrary tournament-ladder challenge records along with the linked court-booking event.

Original NVD description (English source)

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS