CVE-2026-106002 in Court Reservation Plugin
Summary
by MITRE • 10/28/2026
The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in the Court Reservation WordPress plugin prior to version 1.12.4 represents a critical failure in access control mechanisms within the application's administrative functionality. Specifically, the flaw resides in the challenge-management action endpoint, which is designed to handle operations related to tournament ladder challenges. In secure web applications, actions that modify state or delete data must be protected by robust authorization checks and nonce verification to prevent unauthorized modifications. However, this particular implementation lacks both authorisation validation and nonces, effectively leaving a significant security gap that allows any user with network access to the WordPress instance to interact with these administrative functions without valid credentials or session tokens.
From a technical perspective, the absence of nonce verification means that the application does not validate whether the request originated from a legitimate form submission by an authenticated administrator. Nonces are typically used in WordPress environments to prevent Cross-Site Request Forgery attacks and ensure that requests are intentional. Furthermore, the lack of authorisation checks implies that the code did not verify if the user initiating the delete operation possessed the necessary capabilities or roles defined within the WordPress permission system. This combination of missing security controls allows unauthenticated actors to craft malicious HTTP requests targeting the specific API endpoint responsible for managing challenges. By exploiting this weakness, an attacker can send a request that triggers the deletion logic without any barrier preventing such action.
The operational impact of this vulnerability is severe due to its potential for data integrity loss and service disruption. An unauthenticated user can delete arbitrary tournament-ladder challenge records stored in the database. These records are critical components of the plugin's core functionality, representing scheduled competitive events between users or teams. Additionally, if a court-booking event was linked to the deleted challenge record, that associated booking is also removed from the system. This results in unintended data loss for legitimate administrators and participants who rely on these schedules for planning and participation. The ability to arbitrarily delete such records can disrupt tournament integrity, cause confusion among users expecting specific events to occur, and potentially lead to financial or reputational damage depending on how the platform is utilized by its community.
This vulnerability aligns with several well-known industry standards regarding web security flaws. It falls under CWE-862, which describes Missing Authorization, as the application failed to enforce proper access controls for a sensitive action. Additionally, it relates to CWE-354, the Improper Validation of Integrity Check Value, because the system did not validate nonces or other integrity checks before processing state-changing requests. In terms of offensive security frameworks like MITRE ATT&CK, this vulnerability facilitates techniques associated with Privilege Escalation and Data Destruction, allowing an attacker to perform actions typically reserved for high-privilege accounts without authentication. The exploitation vector is classified under Web Application Request Manipulation, where attackers exploit poorly validated inputs or missing server-side checks to alter application state.
To mitigate this risk, immediate action must be taken by updating the Court Reservation WordPress plugin to version 1.12.4 or later, where these security controls have presumably been implemented. Administrators should also ensure that their WordPress installations are kept up-to-date with all available patches for core software and other plugins to reduce the overall attack surface. For environments where immediate patching is not feasible due to compatibility concerns, temporary mitigations may include restricting access to the wp-admin directory via IP whitelisting or implementing a Web Application Firewall rule set that blocks requests lacking valid nonces to known vulnerable endpoints. Regular security audits and code reviews focusing on authorization logic in custom WordPress plugins are recommended to prevent similar vulnerabilities from being introduced in future updates.