WordPress Plugin Vulnerabilities

Court Reservation < 1.10.9 - Event Deletion via CSRF

Description

The plugin does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via a CSRF attack

Proof of Concept

Affects Plugins

Plugin icon
court-reservation
Fixed in 1.10.9

References

CVE
CVE-2026-1508

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
fc1d577b-abf9-4c15-a96d-14ebd894debc

Timeline

Publicly Published
2026-02-17 (about 21 days ago)
Added
2026-02-17 (about 21 days ago)
Last Updated
2026-02-17 (about 21 days ago)

Other

Published
Title
Published
2024-01-16
Title
Better Anchor Links <= 1.7.5 - Cross-Site Request Forgery via admin/options.php
Published
2024-06-28
Title
Preschool and Kindergarten < 1.2.2 - Cross-Site Request Forgery to Notice Dismissal
Published
2023-10-17
Title
Stripe Gateway < 7.6.1 - Cross-Site Request Forgery
Published
2014-08-01
Title
Dimension - CSRF
Published
2023-08-16
Title
Enhanced Ecommerce Google Analytics for WooCommerce < 3.7.2 - CSRF