CVE-2026-1508

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1508", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-01-27T20:42:36.100Z", "datePublished": "2026-03-10T06:00:06.715Z", "dateUpdated": "2026-03-10T12:58:58.315Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-03-10T06:00:06.715Z"}, "title": "Court Reservation < 1.10.9 - Event Deletion via CSRF", "problemTypes": [{"descriptions": [{"description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Court Reservation", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.10.9"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via a CSRF attack"}], "references": [{"url": "https://wpscan.com/vulnerability/fc1d577b-abf9-4c15-a96d-14ebd894debc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Bob Matyas", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T12:58:47.557357Z", "id": "CVE-2026-1508", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T12:58:58.315Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-1508", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T12:58:47.557357Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T12:58:42.865Z"}}], "cna": {"title": "Court Reservation < 1.10.9 - Event Deletion via CSRF", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bob Matyas"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Court Reservation", "versions": [{"status": "affected", "version": "0", "lessThan": "1.10.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/fc1d577b-abf9-4c15-a96d-14ebd894debc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via a CSRF attack"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-03-10T06:00:06.715Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1508", "state": "PUBLISHED", "dateUpdated": "2026-03-10T12:58:58.315Z", "dateReserved": "2026-01-27T20:42:36.100Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-03-10T06:00:06.715Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Court Reservation", "vendor": "Unknown", "versions": [{"lessThan": "1.10.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via a CSRF attack"}, {"lang": "es", "value": "El plugin de WordPress Court Reservation anterior a 1.10.9 no tiene una verificaci\u00f3n CSRF implementada al eliminar eventos, lo que podr\u00eda permitir a los atacantes hacer que un administrador con sesi\u00f3n iniciada los elimine a trav\u00e9s de un ataque CSRF."}], "id": "CVE-2026-1508", "lastModified": "2026-06-17T10:15:58.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1508", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T12:58:47.557357Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:32:18.333", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/fc1d577b-abf9-4c15-a96d-14ebd894debc/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.10.9)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "Court Reservation", "source": "cna", "vendor": "Unknown"}, "product": "court_reservation", "vendor": "court_reservation"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T09:53:19.552839+00:00", "value": {"mitigation_remediation": ["Apply the latest plugin update (v1.10.9 or newer) to remove the CSRF oversight.", "If updating immediately is not possible, implement a CSRF nonce or token on the event deletion form and enforce its validation on the server side.", "Restrict administrative privileges and enable two\u2011factor authentication for admin accounts to reduce the chance that a compromised or hijacked session can execute unintended deletions.", "Monitor WordPress audit logs for unexpected event deletion events and review user activity regularly."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized deletion of scheduled events by an authenticated admin through a CSRF exploit"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Court Reservation plugin from an unknown vendor, specifically any installation running a version prior to 1.10.9. No other plugins or core WordPress versions are mentioned in the report.", "description_and_impact": "The Court Reservation WordPress plugin version 1.10.9 and earlier lacks a CSRF check when an administrator deletes an event, allowing an attacker to generate a crafted request that causes the admin to remove events unintentionally. This flaw can lead to loss of booking data and disruption of service availability for users. The weakness is a classic CSRF violation, categorized as CWE\u2011352.", "risk_and_exploitability": "With a CVSS score of 4.3 the risk is moderate, and the EPSS score is below 1% indicating a low likelihood of exploitation in the current period. The flaw is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to coerce a logged\u2011in administrator into visiting a malicious link or loading a malicious page that triggers the deletion action, which means the threat vector is a straightforward CSRF attack."}}}}, "created": "2026-03-11T11:50:34.601270+00:00", "updated": "2026-04-16T10:00:14.077018+00:00", "vendors": ["court_reservation", "court_reservation$PRODUCT$court_reservation", "wordpress", "wordpress$PRODUCT$wordpress"]}