Court Reservation CVE-2026-106003

No special conditions beyond having the Court Reservation plugin (any version before 1.12.4) installed and active - one of its AJAX actions performs no authentication, authorization, or nonce validation, so a remote unauthenticated attacker can invoke it against default installations to add or delete reservation types. The only meaningful limits on impact are scope and consequence, not access: the flaw affects a single configuration function (reservation types) and yields integrity tampering only (no data disclosure, code execution, or denial of service per C:N/A:N), so damage is confined to corrupting booking configuration rather than broader site compromise.

This is a moderate, non-urgent issue - the signals are consistent and point to limited real-world danger despite the network-reachable, unauthenticated nature of the flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with low complexity and no user interaction, so the barrier to triggering it is minimal; however, the impact is deliberately scoped to I:L only (C:N/A:N), reflecting that an attacker can only tamper with one category of plugin configuration data (reservation types), not read data, execute code, or take the site down. EPSS is low at 0.19% (9th percentile), the CVE is NOT on CISA KEV, and no public exploit is identified in the input, so there is no evidence of active or imminent widespread exploitation. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with the low-severity, low-EPSS, no-KEV picture. Net: this is a legitimate broken-access-control bug worth patching on a normal cycle, not a high-CVSS-but-illusory issue and not an emergency. One nuance to verify: the input tags this as 'Authentication Bypass,' but CWE-284 and the description (missing authorization/authentication/nonce on an AJAX action) describe broken access control / missing authorization rather than a credential or session bypass - the practical effect is the same (unauthenticated access) but the classification is imprecise.

An unauthenticated attacker sends a crafted HTTP POST to the plugin's unprotected admin-ajax.php action and adds bogus reservation types or deletes legitimate ones, corrupting the court booking configuration and disrupting the site owner's scheduling. Because no authentication, authorization, or nonce check is performed and no user interaction is needed (AV:N/AC:L/PR:N/UI:N), the request can be scripted and repeated against any vulnerable site. No public exploit code is identified in the provided data, but the trivial trigger means weaponization would be straightforward.