---
id: "CVE-2026-106003"
kind: "vulnerability"
aliases: ["CVE-2026-106003"]
title: "Court Reservation WordPress plugin: unauthenticated users can change reservation types"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["court-reservation", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-1.12.4-or-later"]
published_at: "2026-10-28T06:16:32+00:00"
first_seen_at: "2026-10-28T06:31:26+00:00"
updated_at: "2026-10-28T06:32:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106003", "first_seen_at": "2026-10-28T06:31:26+00:00"}]
---

# Court Reservation WordPress plugin: unauthenticated users can change reservation types

The Court Reservation WordPress plugin before 1.12.4 has an AJAX action with no authorization, authentication or nonce check. An unauthenticated visitor can add or delete reservation types in the plugin's configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Court Reservation plugin in the WordPress admin Plugins screen; versions before `1.12.4` are affected.
- unknown

## Fix

- Update the Court Reservation plugin to `1.12.4` or later.
- unknown

## Timeline

- 2026-10-28T06:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106003

## From the sources

The Court Reservation  WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation  WordPress plugin before 1.12.4's configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_