What is the CVSS score of CVE-2026-12133?

CVE-2026-12133 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

JoomSport CVE-2026-12133

EUVD-2026-40887 MEDIUM

Missing Authorization (CWE-862)

2026-07-01 Wordfence

GHSA-rqx7-vhrr-mqm2

Authentication Bypass WordPress Joomsport For Sports

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-exploitable by any authenticated subscriber with no complexity barrier; impact is integrity-only (group record deletion), with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:31 vuln.today

CVE Published

Jul 01, 2026 - 03:43 nvd

MEDIUM 4.3

DescriptionCVE.org

The JoomSport - for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check in the joomsport_season_groupdel() AJAX handler, which only verifies a nonce before executing a DELETE query on attacker-supplied group IDs. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary JoomSport group records.

AnalysisAI

Arbitrary group deletion in the JoomSport WordPress plugin (versions ≤5.7.8) is achievable by any authenticated subscriber-level user due to a missing capability check in the joomsport_season_groupdel() AJAX handler. The handler validates a WordPress nonce - preventing CSRF - but never calls current_user_can() or equivalent, allowing any logged-in user to supply attacker-controlled group IDs to an unguarded DELETE query. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; real-world risk is bounded by the requirement for a valid WordPress account and the limited scope of impact (group record deletion only).

Technical ContextAI

JoomSport is a WordPress plugin by BearDev for managing sports leagues, teams, and results. The vulnerable function joomsport_season_groupdel() is registered as a WordPress AJAX handler and is located in includes/posts/joomsport-post-season.php (line 296 in both the tagged 5.7.8 release and trunk). The root cause is CWE-862 (Missing Authorization): WordPress nonce verification (wp_verify_nonce) is a CSRF defense, not an access-control mechanism - it confirms that the request originated from the authenticated session but does not verify what that user is permitted to do. A proper implementation would additionally call current_user_can() with an appropriate capability (e.g., manage_options or a plugin-defined cap) before executing the DELETE query. Because the nonce is accessible to any logged-in user and the handler accepts attacker-supplied group IDs without a privilege gate, the authorization boundary is entirely absent. The CPE identifier is cpe:2.3:a:beardev:joomsport_-_for_sports:_team_&_league,_football,_hockey_&_more:*:*:*:*:*:*:*:*.

RemediationAI

Upstream fix available (SVN changeset revision 3581673 committed to the WordPress plugin repository trunk); however, the exact released patched version number is not independently confirmed in the provided data - administrators should update the JoomSport plugin to the latest version available in the WordPress plugin directory and verify the version exceeds 5.7.8. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/03122c29-4ca5-426a-8240-74ce96dd21f2 should be consulted for confirmed fix version once published. As a compensating control prior to patching, disable open user registration on any WordPress site running JoomSport (Settings → General → uncheck 'Anyone can register'), which eliminates the PR:L attack surface entirely for externally-facing sites. Temporarily deactivating the JoomSport plugin also neutralizes the vulnerability with the trade-off of disabling all plugin functionality. Do not rely on nonce-only validation as a security control - it is insufficient.