Vulnerability · Published Nov 7, 2026 · Assigned by WPScan

CVE-2026-121380Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API

Medium 5.3

In plain English

A medium-severity information exposure in Tournamatch from Unknown. There are no confirmed reports of exploitation so far.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)–no EPSS score yet

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Tournamatch	0 – before 4.7.1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/29e1d36d-1cab-4b0d-abda-a4208f81478a/ exploit, vdb-entry, technical-description