PT-2026-40457 · WordPress · Court Reservation – Manage Your Court Bookings Online

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-1250

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Court Reservation – Manage Your Court Bookings Online versions prior to 1.10.12

Description The Court Reservation – Manage Your Court Bookings Online plugin for WordPress contains a generic SQL Injection flaw. This issue occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Unauthenticated attackers can append additional SQL queries via the id parameter to extract sensitive information from the database.

Recommendations Update the plugin to a version later than 1.10.11. As a temporary workaround, restrict access to the functionality utilizing the id parameter until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-1250

Affected Products

Court Reservation – Manage Your Court Bookings Online

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1250 · Security Note
• https://plugins.trac.wordpress.org/browser/court-reservation/tags/1.10.8/public/class-courtres-public.php#L97 · Note
• https://twitter.com/VulmonFeeds/status/2054407100017541331 · Twitter Post
• https://t.me/CVEtracker/53571 · Telegram Post
• https://t.me/cveNotify/163310 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2054418869393977649 · Twitter Post
• https://twitter.com/CVEnew/status/2054340925283778721 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a482f6bb-5277-480b-8ec9-230dd4135f7c?source=cve · Note