---
id: CVE-2026-106003
title: >-
  Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and
  Deletion
summary: >-
  The Court Reservation  WordPress plugin before 1.12.4 does not perform any
  authorization, authentication or nonce validation on one of its AJAX actions,
  allowing unauthenticated users to add or delete reservation types in the Court
  Reser…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-284
product: Court Reservation
affected:
  - court_reservation < 1.12.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T17:48:18.035709Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:08.395Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106003'
references:
  - url: 'https://wpscan.com/vulnerability/1aa4c6a3-e82a-44c2-a267-4f95b657a1aa/'
tags:
  - cve.org
epss: 0.00268
epssPercentile: 0.19094
ingestedAt: '2026-10-28T07:06:27.152Z'
---

## Overview

The Court Reservation  WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation  WordPress plugin before 1.12.4's configuration.

## Affected

- `court_reservation < 1.12.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.