5.3
Medium
CVE-2026-121380 Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API
Description
The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Tournamatch 4.7 | earliest → < 4.7.1 | 4.7.1 |
Other CVEs of Tournamatch
The 4 CVEs of Tournamatch →
CVE-2026-121379
Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion
9.6
Critical
CVE-2024-5644
The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow…
5.4
Medium
CVE-2024-5627
The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with…
5.4
Medium