{"id":"CVE-2026-121380","kind":"vulnerability","aliases":["CVE-2026-121380"],"related":[],"title":"Tournamatch WordPress plugin: unauthenticated users can read team invitee emails","description":"The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.","summary":"The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing. An unauthenticated visitor can retrieve the email addresses of people invited to join teams.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","tournamatch","wordpress"],"not_affected_if":["plugin-not-installed","version-4.7.1-or-later"],"how_to_check":"- Check the installed Tournamatch version in the WordPress admin plugin list or in the plugin's main file header.\n- Look for the `tournamatch` plugin directory under `wp-content/plugins/`.","fix":"- Tournamatch plugin: move to `4.7.1` or later.","status":"open","published_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:22+00:00","updated_at":"2026-11-07T06:48:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- Tournamatch plugin: move to `4.7.1` or later.","reach":"internet","title":"Tournamatch WordPress plugin: unauthenticated users can read team invitee emails","impact":"low","summary":"The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing. An unauthenticated visitor can retrieve the email addresses of people invited to join teams.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","tournamatch","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attackers read email addresses of users invited to teams","analyst_note":"","how_to_check":"- Check the installed Tournamatch version in the WordPress admin plugin list or in the plugin's main file header.\n- Look for the `tournamatch` plugin directory under `wp-content/plugins/`.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-4.7.1-or-later"],"who_is_affected":"Sites running the Tournamatch WordPress plugin before 4.7.1 are exposed, since the team invitation listing is reachable without logging in. Sites not using this plugin, or running 4.7.1 or later, are not affected. The sources do not say whether the exposure depends on any particular setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":4187,"output_tokens":516,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121380':13A,16A '-2026':12A,15A '4.7.1':28B,57C 'access':32B,61C 'address':45B,74C 'allow':67C 'cve':11A,14A 'email':10A,44B,73C 'host':20B 'invit':36B,48B,65C,77C 'invite':9A 'join':50B,79C 'list':37B,66C 'packag':17B 'peopl':47B,76C 'plugin':3A,26B,55C 'read':7A 'restrict':31B,60C 'retriev':42B,71C 'self':19B 'self-host':18B 'team':8A,35B,51B,64C,80C 'tournamatch':1A,21B,24B,53C 'unauthent':4A,39B,68C 'user':5A,69C 'visitor':40B 'wordpress':2A,22B,25B,54C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Tournamatch WordPress plugin before 4.7.1 are exposed, since the team invitation listing is reachable without logging in. Sites not using this plugin, or running 4.7.1 or later, are not affected. The sources do not say whether the exposure depends on any particular setting.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","tournamatch","wordpress"],"campaign_type":null,"search_a":"'-121380':13A,16A '-2026':12A,15A 'cve':11A,14A 'email':10A 'invite':9A 'plugin':3A 'read':7A 'team':8A 'tournamatch':1A 'unauthent':4A 'user':5A 'wordpress':2A","search_b":"'4.7.1':28B 'access':32B 'address':45B 'email':44B 'host':20B 'invit':36B,48B 'join':50B 'list':37B 'packag':17B 'peopl':47B 'plugin':26B 'restrict':31B 'retriev':42B 'self':19B 'self-host':18B 'team':35B,51B 'tournamatch':21B,24B 'unauthent':39B 'visitor':40B 'wordpress':22B,25B","search_c":"'4.7.1':57C 'access':61C 'address':74C 'allow':67C 'email':73C 'invit':65C,77C 'join':79C 'list':66C 'peopl':76C 'plugin':55C 'restrict':60C 'retriev':71C 'team':64C,80C 'tournamatch':53C 'unauthent':68C 'user':69C 'wordpress':54C","first_public_at":"2026-11-07T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121380","severity":null,"published_at":"2026-11-07T06:16:58+00:00","modified_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}