Court Reservation EUVD-2026-111703

No authentication, user interaction, or special configuration is required (PR:N/UI:N/AC:L): the vulnerable challenge-management action lacks both an authorization check and nonce verification, so it is reachable by any unauthenticated remote user against a site running the Court Reservation plugin before 1.12.4. Exploitation requires that this specific plugin be installed and the vulnerable action exposed, and that target challenge records (optionally with linked court-booking events) exist to delete. The practical limiting factor is impact scope: the flaw only permits deletion of tournament-ladder challenge records and their linked booking events - it does not expose data (C:N) or grant code execution, so damage is confined to loss/destruction of these application records.

This is a moderate-severity broken-access-control issue (CWE-862) with a clean, internally consistent set of signals that point to limited real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction - easy to trigger - but impact is capped at I:L (C:N/A:N), i.e. unauthorized deletion of specific application records rather than code execution, data theft, or site takeover, which is why the base score lands at 5.3 rather than critical. The EPSS score of 0.15% (4th percentile) is very low and aligns with the absence of a CISA KEV listing and the absence of any exploit/PoC reference in the input (references are only the WPScan advisory and the NVD detail page), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month,' consistent with a patch-when-convenient posture rather than an emergency. No SSVC decision fields were supplied. The signals do not conflict: easy-to-exploit mechanics are offset by low concrete impact, low exploitation probability, and no evidence of active exploitation - this is a genuine fix-this-cycle web vulnerability, not a drop-everything priority, and its practical risk depends heavily on how widely this niche plugin is deployed.

An unauthenticated attacker sends a crafted request directly to the plugin's vulnerable challenge-management action, which performs no authorization or nonce check, causing the targeted tournament-ladder challenge record - and any linked court-booking event - to be deleted. Repeated against enumerated or guessed record identifiers, this lets a remote attacker wipe challenge and booking data without any credentials. No public exploit code is identified in the provided sources.