JoomSport CVE-2026-11920

Two distinct exploitation paths exist with different prerequisites. Direct path: attacker must hold an authenticated WordPress session with administrator-level privileges or higher; no special configuration is required beyond the plugin being active. CSRF-mediated path: requires no attacker credentials, but depends on (1) an administrator being actively logged into wp-admin with a valid session cookie, (2) the attacker successfully social-engineering that administrator into issuing a GET request to the crafted URL (UI:R), and (3) the absence of additional CSRF defenses at the infrastructure layer. For both paths, the vulnerability is only triggered when the 'orderby' parameter is present and non-empty alongside the injected 'order' parameter - requests with 'order' alone do not trigger the flaw. Exploitation is limited to read-only database exfiltration (C:H only); no write or availability impact is possible. Sites with wp-admin restricted to internal networks are substantially protected against the CSRF path.

The official CVSS 3.1 score of 4.9 (PR:H/UI:N) captures only the direct authenticated attack path and likely underrepresents real-world risk. The description explicitly documents a CSRF-mediated path (PR:N/UI:R) where an unauthenticated attacker can trigger the injection by luring an active administrator into clicking a crafted link - an attack that scores approximately 6.5 on a complete CVSS vector. These two signals conflict: the official vector omits the CSRF vector's elevated reachability. No EPSS data is available in the provided intelligence. Neither CISA KEV listing nor public POC code has been identified, indicating no confirmed active exploitation at time of analysis. The impact is confidentiality-only (C:H/I:N/A:N), meaning only data exfiltration is achievable - no write or denial-of-service. Real-world priority should be elevated above the 4.9 score for sites with active administrator sessions and internet-exposed wp-admin, particularly those managing sensitive league or membership data.

An unauthenticated attacker identifies a WordPress site running JoomSport ≤ 5.7.9, then crafts a GET URL targeting the vulnerable admin boxfields page with a time-based SQL payload injected into the 'order' parameter and a non-empty 'orderby' parameter also present. The attacker emails or posts the URL to the site administrator; when the logged-in administrator's browser follows the link, the missing nonce check allows the request to execute, and the time-delay responses leak WordPress database contents - including user credentials, email addresses, and plugin data - to the attacker who monitors response timing. No public POC has been identified at time of analysis, though the CSRF attack path is straightforward for anyone familiar with WordPress admin SQL injection patterns.