Vulnerability · Published Nov 7, 2026 · Assigned by WPScan
CVE-2026-121380Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API
Unrated
In plain English
A security flaw in Tournamatch from Unknown. There are no confirmed reports of exploitation so far.
Severity (CVSS )–Not rated
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Tournamatch | 0 – before 4.7.1 |
References
- https://wpscan.com/vulnerability/29e1d36d-1cab-4b0d-abda-a4208f81478a/ exploit, vdb-entry, technical-description