What is the CVSS score of CVE-2026-57749?

CVE-2026-57749 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SportsPress Pro are affected by CVE-2026-57749?

SportsPress Pro plugin (versions ≤2.7.29) enables authenticated contributors to read sensitive server files including database credentials and configuration data, creating an insider threat vector…

How to fix or mitigate CVE-2026-57749?

24 hours: Inventory all WordPress installations running SportsPress Pro ≤2.7.29; restrict Contributor and Author roles to trusted staff only and disable the plugin if not essential. 7 days: Implement file-access monitoring for wp-config.php and related configuration files; check Patchstack advisories for vendor patch availability. 30 days: Review access logs for unauthorized file read attempts; develop plugin replacement or upgrade strategy pending patch release.

SportsPress Pro CVE-2026-57749

EUVD-2026-41305 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-02 Patchstack

GHSA-h7mh-qq2p-78hm

PHP WordPress Information Disclosure LFI Wordpress Plugin Sportspress Pro Themeboy

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Network-reachable but Contributor auth needed (PR:L) and non-trivial to trigger (AC:H); LFI is primarily confidentiality (C:H), with limited I/A absent confirmed code execution.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:24 vuln.today

DescriptionCVE.org

Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.

AnalysisAI

Local File Inclusion in the SportsPress Pro WordPress plugin (versions 2.7.29 and earlier) lets an authenticated user holding at least Contributor privileges cause the application to include and disclose arbitrary local files on the server. Because the flaw is rooted in unsafe PHP file inclusion (CWE-98), a successful attacker can read sensitive files such as wp-config.php and, depending on which local files can be included, potentially escalate toward code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the finding is documented by Patchstack.

Technical ContextAI

SportsPress Pro is a commercial extension of the ThemeBoy SportsPress plugin used to build sports club, league, and team websites on WordPress/PHP (CPE cpe:2.3:a:themeboy:sportspress_pro). The vulnerability class is CWE-98, Improper Control of Filename for Include/Require Statement in a PHP program - i.e., a parameter that flows into a PHP include/require without adequate validation or path restriction. When user-controllable input is used to build the path passed to an include statement, an attacker can traverse the filesystem to pull in local files. In PHP, such inclusion can go beyond simple disclosure when includable content (log files, session files, uploads) can be coerced to contain executable PHP, which is why this CWE is treated more seriously than a plain path-traversal read.

RemediationAI

No vendor-released patch version is confirmed in the provided data - the advisory identifies the vulnerable range as SportsPress Pro <= 2.7.29, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sportspress-pro/vulnerability/wordpress-sportspress-pro-plugin-2-7-29-local-file-inclusion-vulnerability) and ThemeBoy for the fixed release and upgrade to the first version above 2.7.29 once published. Until a patched version is confirmed and applied, the highest-value compensating control is to eliminate the low-privilege attacker: disable open user registration or downgrade untrusted Contributor accounts (trade-off: blocks guest-author workflows), and require review/approval before granting Contributor rights. Additionally, place a WAF rule (e.g., Patchstack's virtual patching) to block path-traversal sequences and suspicious file parameters against SportsPress endpoints, and harden PHP to reduce inclusion impact by setting open_basedir to restrict readable paths and disabling allow_url_include/allow_url_fopen (trade-off: may affect plugins that legitimately fetch remote resources).