What is the CVSS score of CVE-2026-12134?

CVE-2026-12134 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.4%.

JoomSport CVE-2026-12134

EUVD-2026-41265 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Wordfence

GHSA-h398-fp2w-9mpg

WordPress Authentication Bypass Wordpress Plugin Joomsport For Sports Beardev

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Requires subscriber-level authentication (PR:L); nonce is passively exposed so complexity is low (AC:L); impact is integrity-only on sports data with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:19 vuln.today

CVE Published

Jul 02, 2026 - 08:33 cve.org

MEDIUM 4.3

DescriptionCVE.org

The JoomSport - for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary season groups or modify existing group names, participants, and round-type options. Exploitation requires obtaining the joomsportajaxnonce, which is exposed on frontend pages that render a JoomSport shortcode.

AnalysisAI

Authorization bypass in the JoomSport WordPress plugin (all versions through 5.7.8) permits any subscriber-level authenticated user to create arbitrary season groups or tamper with group names, participant records, and round-type options - sports league data that site administrators should exclusively control. The flaw, identified by Wordfence and rooted in CWE-862 (Missing Authorization), is exploitable by any registered WordPress user who can load a page rendering a JoomSport shortcode to harvest a required nonce. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.3 Medium score accurately reflects a bounded, integrity-only impact with no path to code execution or privilege escalation.

Technical ContextAI

The vulnerability resides in the BearDev JoomSport plugin's AJAX handlers, specifically within includes/posts/joomsport-post-season.php at lines 22 and 230 (confirmed via WordPress Plugin Trac source references). The plugin invokes privileged season management actions - creating and modifying season groups, participants, and round types - over WordPress AJAX without performing a capability check against the requesting user's role. CWE-862 (Missing Authorization) identifies the root cause: the code validates the nonce (CSRF token) to confirm request origin but omits the separate authorization check that would confirm the user holds a role permitted to perform the action. The joomsportajaxnonce used for request validation is emitted into frontend page HTML by the shortcode handler (includes/joomsport-shortcodes.php, line 473) whenever a JoomSport shortcode is rendered, making it passively accessible to any visitor who can load such a page. The CPE cpe:2.3:a:beardev:joomsport_-_for_sports:_team_&_league,_football,_hockey_&_more:*:*:*:*:*:*:*:* covers all versions with no version floor, confirming the entire release history through 5.7.8 is affected.

RemediationAI

A code fix has been committed to the plugin's trunk on WordPress Plugin Trac (changeset https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3581673%40joomsport-sports-league-results-management&new=3581673%40joomsport-sports-league-results-management&sfp_email=&sfph_mail=), but a specific patched release version number is not confirmed in the available data - site owners should update to the latest available version via the WordPress plugin repository dashboard and verify the installed version exceeds 5.7.8. As an interim compensating control, disabling open user registration prevents unauthenticated visitors from obtaining subscriber accounts needed to exploit the flaw; note this also prevents legitimate sign-ups. A second compensating measure is removing JoomSport shortcodes from all frontend pages, which eliminates nonce exposure and blocks the prerequisite for exploitation, but disables all plugin display functionality. Restricting subscriber-role users via a role management plugin (e.g., blocking AJAX endpoints with a WAF rule targeting JoomSport action names) can reduce exposure without disabling features. Consult the Wordfence advisory for updated remediation guidance as a confirmed patched version becomes available.