---
id: "CVE-2026-106002"
kind: "vulnerability"
aliases: ["CVE-2026-106002"]
title: "Court Reservation WordPress plugin lets anyone delete challenge and booking records"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["court-reservation", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-updated-to-1.12.4"]
published_at: "2026-10-28T06:16:32+00:00"
first_seen_at: "2026-10-28T06:31:26+00:00"
updated_at: "2026-10-28T06:32:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106002", "first_seen_at": "2026-10-28T06:31:26+00:00"}]
---

# Court Reservation WordPress plugin lets anyone delete challenge and booking records

The Court Reservation WordPress plugin before 1.12.4 has a challenge-management action with no authorisation or nonce check. An unauthenticated visitor can delete arbitrary tournament-ladder challenge records and the linked court-booking events.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Court Reservation plugin in the WordPress admin Plugins screen; versions below `1.12.4` are affected.
- Run `wp plugin get court-reservation --field=version` (slug assumed; confirm the slug with `wp plugin list`).

## Fix

- Update the Court Reservation plugin to `1.12.4` or later.
- If an update is not possible, deactivate the plugin until it is updated.

## Timeline

- 2026-10-28T06:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106002

## From the sources

The Court Reservation  WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_