CVE-2026-1508: 
WordPress vulnerability analysis and mitigation

CVE-2026-1508 is a Cross-Site Request Forgery (CSRF) vulnerability in the Court Reservation WordPress plugin that allows unauthenticated attackers to trick a logged-in administrator into deleting all events. It affects all versions of the plugin before 1.10.9 and was publicly disclosed on February 17, 2026, with NVD publication on March 10, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (WPScan, Red Hat CVE).

The root cause is a missing CSRF token validation (CWE-352) on the event deletion functionality within the Court Reservation plugin's admin interface. An attacker can craft a malicious HTML page containing a form that auto-submits a POST request to the plugin's event deletion endpoint (/wp-admin/admin.php?page=courtres-event), which the server processes without verifying the request's origin. Exploitation requires no privileges on the part of the attacker but does require user interaction — specifically, a logged-in WordPress administrator must be socially engineered into visiting the attacker-controlled page. A working proof-of-concept was published alongside the disclosure by researcher Bob Matyas (WPScan).

Successful exploitation results in the deletion of all events managed by the Court Reservation plugin, causing a loss of data integrity and availability for the affected WordPress site's reservation system. There is no confidentiality impact, as the attack does not expose sensitive data. The impact is limited in scope to the plugin's event data, but for organizations relying on the plugin for court or facility bookings, mass event deletion could cause significant operational disruption (WPScan, Red Hat CVE).

A public proof-of-concept exploit was released alongside the vulnerability disclosure on February 17, 2026, making exploitation straightforward for any attacker capable of delivering a malicious HTML page to an administrator. The EPSS score is very low at 0.003%, reflecting limited observed exploitation activity. There is no evidence of in-the-wild exploitation, threat actor attribution, or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (WPScan, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the Court Reservation plugin running a version prior to 1.10.9 (e.g., via WPScan or by inspecting plugin directories).
2. Craft malicious HTML page: Create an HTML file containing a hidden form that targets the event deletion endpoint (/wp-admin/admin.php?page=courtres-event) with the appropriate POST parameters to delete events.
3. Add auto-submit JavaScript: Include JavaScript that automatically submits the form on page load using multiple fallback methods (e.g., DOMContentLoaded, setTimeout, window.onload) to maximize reliability.
4. Social engineering delivery: Deliver the malicious HTML page to a logged-in WordPress administrator via phishing email, malicious link, or compromised website.
5. Trigger deletion: When the administrator opens the page, the form auto-submits, and the server — lacking CSRF validation — processes the request and deletes all events in the Court Reservation plugin (WPScan).

• Logs: WordPress access logs showing unexpected POST requests to /wp-admin/admin.php?page=courtres-event from unusual referrer origins or with a missing/empty Referer header, particularly if followed by mass event deletion.
• Application: Sudden disappearance of all events in the Court Reservation plugin's admin panel without a corresponding administrator action in audit logs.
• Network: HTTP requests to the event deletion endpoint originating from an external or unexpected domain as the Referer header value.

The vendor has released version 1.10.9 of the Court Reservation WordPress plugin, which adds proper CSRF token validation to the event deletion functionality. Site administrators should update the plugin to version 1.10.9 or later immediately. No configuration-based workaround is available; upgrading is the only effective remediation (WPScan).

The vulnerability was discovered and responsibly disclosed by researcher Bob Matyas, who also submitted the finding to WPScan. No significant vendor statements beyond the plugin update, major media coverage, or notable community discussion have been identified for this moderate-severity issue.