CVE-2026-121380

Full vulnerability record from the local CVENow database.

Description

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-07 06:16:58.160000

Last modified

2026-11-07 06:16:58.160000

View original CVE JSON

{
  "id": "CVE-2026-121380",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-07T06:16:58.160",
  "lastModified": "2026-11-07T06:16:58.160",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Tournamatch",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "4.7.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/29e1d36d-1cab-4b0d-abda-a4208f81478a/",
      "source": "[email protected]"
    }
  ]
}