{"api_version":"1","generated_at":"2026-10-28T08:01:38+00:00","cve":"CVE-2026-106003","urls":{"html":"https://cve.report/CVE-2026-106003","api":"https://cve.report/api/cve/CVE-2026-106003.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-106003","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-106003"},"summary":{"title":"Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion","description":"The Court Reservation  WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation  WordPress plugin before 1.12.4's configuration.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-10-28 06:16:32","updated_at":"2026-10-28 06:16:32"},"problem_types":["CWE-284 Improper Access Control"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/1aa4c6a3-e82a-44c2-a267-4f95b657a1aa/","name":"https://wpscan.com/vulnerability/1aa4c6a3-e82a-44c2-a267-4f95b657a1aa/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106003","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106003","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Court Reservation","version":"affected 1.12.4 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Muni Nitish Kumar Yaddala","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Court Reservation","vendor":"Unknown","versions":[{"lessThan":"1.12.4","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Muni Nitish Kumar Yaddala"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Court Reservation  WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation  WordPress plugin before 1.12.4's configuration."}],"problemTypes":[{"descriptions":[{"description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-28T06:00:21.700Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/1aa4c6a3-e82a-44c2-a267-4f95b657a1aa/"}],"source":{"discovery":"EXTERNAL"},"title":"Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-106003","datePublished":"2026-10-28T06:00:21.700Z","dateReserved":"2026-10-06T11:50:47.859Z","dateUpdated":"2026-10-28T06:00:21.700Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-28 06:16:32","lastModifiedDate":"2026-10-28 06:16:32","problem_types":["CWE-284 Improper Access Control"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"106003","Ordinal":"1","Title":"Court Reservation < 1.12.4 - Unauthenticated Reservation Type Ad","CVE":"CVE-2026-106003","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"106003","Ordinal":"1","NoteData":"The Court Reservation  WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation  WordPress plugin before 1.12.4's configuration.","Type":"Description","Title":"Court Reservation < 1.12.4 - Unauthenticated Reservation Type Ad"}]}}}