What is the CVSS score of CVE-2026-1250?

CVE-2026-1250 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Court Reservation are affected by CVE-2026-1250?

The Court Reservation WordPress plugin (versions 1.10.11 and earlier) contains an unauthenticated SQL injection vulnerability that enables unauthorized extraction of user credentials and booking data…

How to fix or mitigate CVE-2026-1250?

Within 24 hours, inventory all WordPress installations to identify those running Court Reservation plugin version 1.10.11 or earlier and immediately restrict their internet-facing access via firewall rules or network segmentation, or disable the plugin if functionality is non-critical. Within 7 days, deploy Web Application Firewall rules to block SQL injection patterns targeting the 'id' parameter, enable detailed logging and alerting on database query anomalies and failed access attempts, and restrict database credentials to minimum necessary permissions. Within 30 days, establish a long-term remediation strategy: if the plugin is essential, evaluate alternative booking platforms with superior security posture or maintain strong network controls and daily database integrity audits pending vendor patch availability; if non-essential, permanently disable and remove the plugin.

Court Reservation CVE-2026-1250

EUVD-2026-29871 HIGH

SQL Injection (CWE-89)

2026-05-12 Wordfence

GHSA-mq8q-4qc4-9h24

WordPress SQLi Wordpress Plugin Court Reservation Manage Your Court Bookings Online

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote SQLi via a public parameter (AV:N/AC:L/PR:N/UI:N) yielding full database read but no write or availability impact (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:07 vuln.today

CVE Published

May 12, 2026 - 22:24 nvd

HIGH 7.5

DescriptionCVE.org

The Court Reservation - Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.10.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in the Court Reservation - Manage Your Court Bookings Online WordPress plugin (versions ≤ 1.10.11) lets unauthenticated attackers inject arbitrary SQL through the 'id' parameter, enabling extraction of sensitive database contents such as user credentials and booking data. The flaw stems from an unescaped, unprepared query and is network-reachable with no authentication or user interaction. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), but SSVC flags exploitation as automatable with partial technical impact.

Technical ContextAI

The vulnerability is a classic CWE-89 SQL Injection: user input from the 'id' HTTP parameter is concatenated into a SQL statement without WordPress's $wpdb->prepare() parameterization or proper escaping. The vulnerable code path is in the plugin's public-facing class (per Wordfence, class-courtres-public.php around line 97 in the 1.10.8 tag), meaning the sink is exposed via an unauthenticated front-end request handler rather than an admin-only page. The affected component is the webmuehle 'Court Reservation' plugin (CPE cpe:2.3:a:webmuehle:court_reservation_-_manage_your_court_bookings_online), a booking/scheduling extension for WordPress-hosted sports facilities. Because WordPress plugins share the site's MySQL/MariaDB database, a successful injection reaches the entire wp_ schema including wp_users and wp_usermeta.

RemediationAI

Upgrade the Court Reservation plugin to a version newer than 1.10.11 as soon as the vendor publishes a fixed release; the input data does not include a confirmed patched version, so consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a482f6bb-5277-480b-8ec9-230dd4135f7c) and the WordPress plugin page for the current fixed build before deploying. Until a patched version is confirmed and installed, the strongest compensating control is a Web Application Firewall (Wordfence or equivalent) with SQLi rules that inspect the vulnerable 'id' parameter, accepting the trade-off of possible false positives on legitimate booking requests. If the plugin is not actively used, deactivate and remove it to eliminate the attack surface entirely; if it is required, restrict access to the reservation front-end pages (for example via IP allowlisting or requiring authentication in front of the booking endpoints) understanding this may block legitimate public bookings. Prioritize a database credential rotation and integrity review if the site has been internet-exposed, since read-only SQLi can already have leaked hashes.