CVE-2026-106003
Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 28, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 6, 2026
Description
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
Court ReservationUnknown |
|
References
- https://wpscan.com/vulnerability/1aa4c6a3-e82a-44c2-a267-4f95b657a1aa/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.