CVE-2026-1250 is an SQL Injection vulnerability (CWE-89) in the Court Reservation – Manage Your Court Bookings Online WordPress plugin affecting all versions up to 1.10.11. The vulnerability arises from improper neutralization of special elements in the 'id' parameter, allowing unauthenticated attackers to append malicious SQL commands to existing queries. This can lead to unauthorized disclosure of sensitive database information. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. No patch or official remediation is currently documented.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks via the 'id' parameter, potentially extracting sensitive information from the backend database. The impact is limited to confidentiality compromise; integrity and availability are not affected according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin or applying custom input validation and query parameterization as a temporary mitigation. Monitor vendor channels for updates.