{"affected":[{"defaultStatus":"unaffected","product":"Tournamatch","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.7.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121380","cwes":["CWE-200"],"description":"The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/29e1d36d-1cab-4b0d-abda-a4208f81478a/"}],"kev":null,"metrics":[],"modifiedAt":1794031226714,"publishedAt":1794031226714,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/29e1d36d-1cab-4b0d-abda-a4208f81478a/"}],"remediation":[],"revision":"766bdcc730f87b5cb9054e8e8c59e21ecb5c14c78790d12c15ab43ff081e16a2","sources":[{"modifiedAt":1794031226714,"name":"CNA: WPScan","retrievedAt":1794031725403,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121380"}],"ssvc":null,"status":"published","title":"Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API","updatedAt":1794031725403}