JoomSport CVE-2026-118192

Requires an authenticated WordPress account with contributor-level privileges or above (PR:L); this is the primary limiting factor, since sites that do not permit untrusted contributor registration sharply reduce the exploitable population. The specific vulnerable code path is reached when a season has no associated joomsport_tournament term - which the description states is the default state for newly created seasons, so the condition is commonly satisfied rather than exotic. The injection is delivered through the 'team_id' parameter, which is insufficiently escaped and not properly prepared in the query. No user interaction is needed (UI:N) and exploitation works against default configurations of the JoomSport plugin for WordPress in all versions up to and including 5.7.11.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity SQL injection that nonetheless requires authentication at contributor level (PR:L), which materially limits the attacker population to users who already hold a plugin/site account - on most WordPress sites contributor registration is not open to the public. Impact is confidentiality-only (C:H, I:N, A:N): the flaw reads sensitive database contents (e.g. user records, secrets) but does not directly alter data or availability. The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent remediation window. No CISA KEV entry and no EPSS score were provided in the input, so there is no signal of active or widespread exploitation; exploitation status is therefore 'no public exploit identified at time of analysis'. The references are Wordfence threat-intel and WordPress plugin source/changeset links - these document the vulnerable code and the fix, not a weaponized exploit. The signals are internally consistent (CVSS auth requirement matches the description's 'contributor-level access and above'), so there is no major conflict; the main caveat is that EPSS and KEV data are simply absent rather than contradictory.

An attacker who holds (or registers/obtains) a contributor-level WordPress account submits a request manipulating the 'team_id' parameter so that crafted SQL is appended to the plugin's existing query, extracting sensitive data such as password hashes or secret keys from the database. Because the vulnerable code path triggers when a season has no associated joomsport_tournament term - the default state for newly created seasons - the condition is readily met on typical installations. No standalone working exploit is confirmed in the input, though Wordfence and WordPress source references document the flaw and its fix.