The vulnerability is a generic SQL injection that occurs when an unauthenticated attacker supplies a crafted value in the id parameter of the Court Reservation plugin. The insufficient escaping and lack of prepared statements allow the attacker to append additional SQL statements to the original query, giving them the ability to read or otherwise retrieve sensitive data stored in the WordPress database. This flaw directly maps to CWE‑89 and can result in information disclosure if the attack succeeds.

The flaw affects the Court Reservation – Manage Your Court Bookings Online WordPress plugin from the vendor webmuehle, in all releases up to and including version 1.10.11. Any site using a legacy version of this plugin is potentially vulnerable.

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication by sending a request containing a malicious id value to the plugin’s public endpoint, thereby gaining read access to the database through the injected SQL.