CVE-2026-121380 · Package
NO FIX YET · SEE WHAT TO DO
The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing. An unauthenticated visitor can retrieve the email addresses of people invited to join teams.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Tournamatch WordPress plugin before 4.7.1 are exposed, since the team invitation listing is reachable without logging in. Sites not using this plugin, or running 4.7.1 or later, are not affected. The sources do not say whether the exposure depends on any particular setting.
Not affected if plugin-not-installed, version-4.7.1-or-later
Who cares self-hosted, tournamatch, wordpress
tournamatch plugin directory under wp-content/plugins/.4.7.1 or later.The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.