JoomSport CVE-2026-118698

Requires an authenticated contributor-level (or higher) WordPress account on a site running JoomSport (vendor beardev) version 5.7.14 or earlier. The specific trigger is authoring a post that contains the [jsMatchPlayerList] shortcode with a crafted 'pgroup' parameter and then previewing that post, since WordPress executes shortcodes during preview for the post's own author. Limiting factors: exploitation is not possible without a contributor account, so sites that do not grant contributor-or-above roles to untrusted users (no open/self-service registration at that level) are not practically exposed; there is no unauthenticated path and no separate victim user interaction is needed beyond the attacker's own preview action.

This is a moderate, authentication-gated risk rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium) indicates a network-reachable, low-complexity attack requiring low privileges, with high confidentiality impact but no integrity or availability impact - consistent with a read-only SQL injection used to exfiltrate database contents. The PR:L requirement is the single most important mitigating factor: the description confirms the attacker must already hold a contributor-level account, and the vulnerable [jsMatchPlayerList] shortcode path is reachable via post preview, which WordPress permits for a post's own author. No EPSS score, CISA KEV listing, or confirmed public exploit code is present in the supplied data; the references are a Wordfence advisory and WordPress plugin-repository source/changeset links (the patch), not working exploit code. The vuln.today decision label is 'this_month,' which aligns with a real-but-not-urgent priority - SQL injection with confidentiality impact is serious, but the contributor-access prerequisite limits it to sites that provision such accounts (e.g., multi-author or open-registration configurations). No signals conflict here: the Medium CVSS, the absence of KEV/EPSS/PoC, and the 'this_month' label all point to a standard scheduled-patching item.

An attacker who holds (or registers for) a contributor-level account on a WordPress site running JoomSport authors a draft post containing the [jsMatchPlayerList] shortcode with a malicious 'pgroup' value, then previews the post; because WordPress executes shortcodes during the author's own preview, the injected SQL runs against the database. The attacker uses the UNION/stacked-query injection to extract sensitive data such as password hashes or user records. No public exploit code is identified in the supplied data, though a Wordfence advisory documents the flaw.