JoomSport CVE-2026-12134

Exploitation requires an active WordPress user account at subscriber level or higher on the target site - unauthenticated visitors cannot exploit this vulnerability, as the PR:L CVSS metric confirms. A second hard prerequisite is that at least one page on the target WordPress installation must have a JoomSport shortcode rendered and accessible to the attacker, since the joomsportajaxnonce is only exposed via shortcode output. Sites with JoomSport installed but no shortcodes on pages accessible to the attacker's session are not exploitable. There is no requirement for a non-default server configuration or operating system. Exploitation is strictly bounded to sports league data integrity - season groups, participants, and round-type options - and cannot achieve remote code execution, privilege escalation to administrator, or data exfiltration. The primary limiting factors are: the requirement for a valid authenticated session (subscriber or above) and the necessity of a JoomSport shortcode page being accessible to that session.

The CVSS 4.3 (Medium) score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately characterizes the risk envelope: network-reachable, low complexity, requires authenticated low-privilege access, and produces only limited integrity impact. Real-world risk is marginally elevated on sites with open user registration, where an adversary can self-register as a subscriber without administrator involvement and then exploit the flaw to corrupt league data (standings, fixtures, participant records). However, the attack is firmly bounded - there is no confidentiality exposure, no availability impact, and no privilege escalation pathway. EPSS data is not provided in the input; given the niche plugin footprint and integrity-only impact, widespread automated exploitation is unlikely. The vulnerability is not in the CISA KEV catalog and no POC code has been published, reinforcing a low urgency posture for most deployments. The primary real-world risk is targeted data integrity abuse on sports club or league management sites rather than broad opportunistic scanning.

An attacker registers a free subscriber account on a WordPress site running JoomSport (or uses an existing low-privilege account), then loads any public page where a JoomSport shortcode is rendered and extracts the joomsportajaxnonce value from the page HTML. Using this nonce and their session cookie, they craft authenticated AJAX POST requests to the season management endpoint to rename participant records, inject fictitious season groups, or alter round-type configurations - corrupting league standings or fixture data without any administrator interaction. No published exploit code is required; only a browser developer console or a basic HTTP client such as curl is sufficient.