Sign in

5.3 Medium

CVE-2026-106002 The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of…

Description

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.

Affected products and versions

Product	Affected versions	Fixed in
Court Reservation 1.12	earliest → < 1.12.4	1.12.4

The 3 CVEs of Court Reservation →

CVE-2026-106003 The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce… 5.3 Medium CVE-2026-1508 The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which… 4.3 Medium

Do you use Court Reservation?

Track this CVE Watch Court Reservation Check my SBOMs

www.cveye.io/en/cve/CVE-2026-106002

Timeline

Published October 28, 2026
Last modified October 28, 2026

References

wpscan.com wpscan.com

Track this CVE