{"id":"CVE-2026-106003","kind":"vulnerability","aliases":["CVE-2026-106003"],"related":[],"title":"Court Reservation WordPress plugin: unauthenticated users can change reservation types","description":"The Court Reservation  WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation  WordPress plugin before 1.12.4's configuration.","summary":"The Court Reservation WordPress plugin before 1.12.4 has an AJAX action with no authorization, authentication or nonce check. An unauthenticated visitor can add or delete reservation types in the plugin's configuration.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["court-reservation","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-1.12.4-or-later"],"how_to_check":"- Check the installed version of the Court Reservation plugin in the WordPress admin Plugins screen; versions before `1.12.4` are affected.\n- unknown","fix":"- Update the Court Reservation plugin to `1.12.4` or later.\n- unknown","status":"open","published_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:50+00:00","updated_at":"2026-10-28T06:32:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Court Reservation plugin to `1.12.4` or later.\n- unknown","reach":"internet","title":"Court Reservation WordPress plugin: unauthenticated users can change reservation types","impact":"medium","summary":"The Court Reservation WordPress plugin before 1.12.4 has an AJAX action with no authorization, authentication or nonce check. An unauthenticated visitor can add or delete reservation types in the plugin's configuration.","category":"package","nicknames":[],"who_cares":["wordpress","court-reservation","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated visitors alter the site's reservation type configuration","analyst_note":"Confirm the affected version range and the vendor's changelog for 1.12.4; the NVD entry does not give a severity score.","how_to_check":"- Check the installed version of the Court Reservation plugin in the WordPress admin Plugins screen; versions before `1.12.4` are affected.\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.12.4-or-later"],"who_is_affected":"Sites running the Court Reservation WordPress plugin before 1.12.4 are exposed, since the unprotected AJAX action is reachable without logging in. Sites that do not have the plugin installed can skip it. The sources do not say whether the flaw depends on any particular plugin setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000598,"input_tokens":3310,"output_tokens":534,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106003':13A,16A '-2026':12A,15A '1.12.4':31B,63C,95C 'action':35B,78C 'add':47B,83C 'ajax':34B,77C 'allow':79C 'authent':39B,69C 'author':38B,68C 'chang':8A 'check':42B 'configur':56B,97C 'court':1A,18B,26B,58C,90C 'court-reserv':17B 'cve':11A,14A 'delet':49B,85C 'host':23B 'nonc':41B,71C 'one':74C 'packag':20B 'perform':66C 'plugin':4A,29B,54B,61C,93C 'reserv':2A,9A,19B,27B,50B,59C,86C,91C 'self':22B 'self-host':21B 'type':10A,51B,87C 'unauthent':5A,44B,80C 'user':6A,81C 'valid':72C 'visitor':45B 'wordpress':3A,24B,28B,60C,92C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Court Reservation WordPress plugin before 1.12.4 are exposed, since the unprotected AJAX action is reachable without logging in. Sites that do not have the plugin installed can skip it. The sources do not say whether the flaw depends on any particular plugin setting.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106003","severity":null,"published_at":"2026-10-28T06:16:32+00:00","modified_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}