The Court Reservation WordPress plugin version 1.10.9 and earlier lacks a CSRF check when an administrator deletes an event, allowing an attacker to generate a crafted request that causes the admin to remove events unintentionally. This flaw can lead to loss of booking data and disruption of service availability for users. The weakness is a classic CSRF violation, categorized as CWE‑352.

The vulnerability affects the Court Reservation plugin from an unknown vendor, specifically any installation running a version prior to 1.10.9. No other plugins or core WordPress versions are mentioned in the report.

With a CVSS score of 4.3 the risk is moderate, and the EPSS score is below 1% indicating a low likelihood of exploitation in the current period. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to coerce a logged‑in administrator into visiting a malicious link or loading a malicious page that triggers the deletion action, which means the threat vector is a straightforward CSRF attack.