The Court Reservation WordPress plugin before version 1.12.4 fails to check user authorization or verify a nonce when processing a challenge‑management action. Unauthenticated users can therefore delete any tournament‑ladder challenge record, and if the challenge is linked to a court‑booking event, that event is also removed. The flaw allows a complete loss of those records without any authentication protection.

Any website running the Court Reservation plugin of a version earlier than 1.12.4.

The vulnerability lacks authentication requirements, making it trivial to exploit for any visitor who can interact with the plugin’s endpoints. Attackers could immediately delete campaign data and disrupt events. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of access control suggests a high potential impact on confidentiality, integrity, and availability.