Live › vulnerability › CVE-2026-106003
Go to dashboardThe Court Reservation WordPress plugin before 1.12.4 has an AJAX action with no authorization, authentication or nonce check. An unauthenticated visitor can add or delete reservation types in the plugin's configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Court Reservation WordPress plugin before 1.12.4 are exposed, since the unprotected AJAX action is reachable without logging in. Sites that do not have the plugin installed can skip it. The sources do not say whether the flaw depends on any particular plugin setting.
No product ranges from the sources yet.
1.12.4 are affected.1.12.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-106003")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.