---
id: "CVE-2026-121380"
page: "https://infrastack.ai/live/CVE-2026-121380"
kind: "vulnerability"
aliases: ["CVE-2026-121380"]
title: "Tournamatch WordPress plugin: unauthenticated users can read team invitee emails"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "tournamatch", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-4.7.1-or-later"]
published_at: "2026-11-07T06:16:58+00:00"
first_seen_at: "2026-11-07T06:46:04+00:00"
updated_at: "2026-11-07T06:48:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121380", "first_seen_at": "2026-11-07T06:46:04+00:00"}]
exploit_sources: []
---

# Tournamatch WordPress plugin: unauthenticated users can read team invitee emails

Link for people: https://infrastack.ai/live/CVE-2026-121380 (this .md is for agents)

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing. An unauthenticated visitor can retrieve the email addresses of people invited to join teams.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Tournamatch version in the WordPress admin plugin list or in the plugin's main file header.
- Look for the `tournamatch` plugin directory under `wp-content/plugins/`.

## Fix

- Tournamatch plugin: move to `4.7.1` or later.

## Timeline

- 2026-11-07T06:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121380

## From the sources

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_