CVE-2026-106003: Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion

Q: Who can exploit this issue?

Any unauthenticated user can exploit the affected AJAX action. No login, authorization, or nonce validation is required.

Q: What can an attacker change?

An attacker can add or delete reservation types in the plugin's configuration.

Q: Which installations are affected?

Court Reservation WordPress plugin versions before 1.12.4 are affected.

Published Oct 28, 2026

Updated

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration.

Affected Software

1 affected component

Court Reservation WordPress plugin<1.12.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Court Reservation WordPress plugin to a version that resolves this vulnerability.
Fixed in 1.12.4

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user can exploit the affected AJAX action. No login, authorization, or nonce validation is required.

What can an attacker change?

An attacker can add or delete reservation types in the plugin's configuration.

Which installations are affected?

Court Reservation WordPress plugin versions before 1.12.4 are affected.

CVE-2026-106003: Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Which installations are affected?