The vulnerability arises because the Court Reservation WordPress plugin does not verify the caller of one of its AJAX actions. This lack of authentication allows an attacker to add or delete reservation types without logging in. This leads to manipulation of the plugin’s data. Based on the description, it is inferred that an attacker could disrupt scheduling logic, misrepresent available resources, or introduce data inconsistencies that might enable further exploitation.

All installations of the Court Reservation WordPress plugin that use a version older than 1.12.4 are affected. The plugin’s vendor is listed as Unknown, but the issue applies to any site that has the plugin installed before the 1.12.4 release.

The EPSS score is not available and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that this unauthenticated authority bypass is high risk if the website is publicly accessible. An attacker can exploit this by sending a POST request to the AJAX endpoint; no prior authentication or complex setup is required. Likely attack vector is an unauthenticated POST to the affected endpoint. Based on the description, it is inferred that the absence of a nonce guard makes the exploitation feasible against any user with network access to the site.