CVE-2026-106003mediumCWE-284

CVE-2026-106003: medium-severity vulnerability in Court Reservation

Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion

Published

Follow this CVE+ Monitor Court Reservation

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.3%
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Court Reservation
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Court Reservation

In the same product, most dangerous first.

CVE-2026-106002MEDIUMCourt Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge DeletionEPSS 0.2%CVE-2026-1508MEDIUMCourt Reservation < 1.10.9 - Event Deletion via CSRFEPSS 0.1%