CVE-2026-1508: CSRF in Court Reservation Plugin

A successful CSRF attack could allow an attacker to perform actions as an authenticated administrator of the WordPress site. This could include creating, modifying, or deleting court bookings, changing plugin settings, or potentially gaining access to sensitive data. The impact is particularly severe because CSRF attacks often rely on social engineering, making it difficult for administrators to detect the malicious activity. The attacker doesn't need to know administrator credentials, only to craft a request that appears legitimate to the browser.

1. Reserved2026-01-27
2. Published2026-02-17
3. Modified2026-03-19
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-1508 is to immediately upgrade the Court Reservation plugin to version 1.10.9 or later. If upgrading is not immediately possible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. Additionally, educate administrators about the risks of clicking on suspicious links and verify the legitimacy of any requests before confirming them. Review WordPress security best practices, including enabling two-factor authentication for administrator accounts.

Active installs

100Known

Plugin rating

5.0

Requires WordPress

3.0.1+

Compatible up to

6.7.5

Requires PHP

5.2.4+