Authorization Flaw in Court Reservation Plugin by WordPress
CVE-2026-106002
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 28 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-106002?
The Court Reservation WordPress plugin versions prior to 1.12.4 is vulnerable due to a lack of authorization and nonce verification in its challenge-management actions. This security issue enables unauthenticated users to delete arbitrary tournament-ladder challenge records and any associated court-booking events, potentially disrupting event organization and affecting user experience.
Affected Version(s)
Court Reservation 0 < 1.12.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.