Live › vulnerability › CVE-2026-106002
Go to dashboardThe Court Reservation WordPress plugin before 1.12.4 has a challenge-management action with no authorisation or nonce check. An unauthenticated visitor can delete arbitrary tournament-ladder challenge records and the linked court-booking events.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Court Reservation WordPress plugin before 1.12.4 that use its tournament-ladder challenge feature are exposed, since the flawed action is reachable without logging in. Sites without this plugin, or with it at 1.12.4 or later, can skip it.
No product ranges from the sources yet.
1.12.4 are affected.wp plugin get court-reservation --field=version (slug assumed; confirm the slug with wp plugin list).1.12.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.
This page as .md · .json · in your agent: get_signal("CVE-2026-106002")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.