EUVD-2026-29913Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The JoomSport - for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'sortf' parameter in all versions up to, and including, 5.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Time-based blind SQL injection in JoomSport WordPress plugin (all versions ≤5.7.7) enables unauthenticated remote attackers to extract sensitive database contents including credentials, user data, and configuration secrets via the unsanitized 'sortf' parameter. CVSS 7.5 (High) with network attack vector, low complexity, and no authentication required. EPSS data not provided; no CISA KEV listing indicates exploitation not yet confirmed in the wild. Wordfence Threat Intel reported this vulnerability with proof-of-concept code references pointing to specific vulnerable functions in class-jsport-getplayers.php and class-jsport-playerlist.php, enabling straightforward exploitation by security researchers and threat actors alike.
Technical ContextAI
This is a classic CWE-89 SQL injection vulnerability in a WordPress plugin designed for sports league management. The affected product is JoomSport (BearDev), identified by CPE cpe:2.3:a:beardev:joomsport_-_for_sports:_team_&_league,_football,_hockey_&_more. The vulnerability exists in the player sorting functionality where the 'sortf' parameter is passed directly into SQL queries without proper sanitization or parameterized statement usage. References point to class-jsport-getplayers.php (line 153) and class-jsport-playerlist.php (line 80) where user input is concatenated into ORDER BY clauses. Time-based blind SQL injection allows attackers to infer data by measuring database response delays, particularly useful when direct error messages are suppressed. WordPress plugins often handle database interactions through the $wpdb global object, and failure to use prepare() methods for dynamic query construction leads to this vulnerability class. The changeset reference (3516487) indicates the patch modifies these specific files to implement proper input validation or prepared statements.
RemediationAI
Upgrade JoomSport plugin to version 5.7.8 or later immediately, as the WordPress plugin repository changeset 3516487 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3516487%40joomsport-sports-league-results-management&new=3516487%40joomsport-sports-league-results-management) indicates patched code addressing the vulnerable class-jsport-getplayers.php and class-jsport-playerlist.php files. Verify patch application by examining that sortf parameter handling now uses WordPress $wpdb->prepare() parameterization. If immediate patching is not feasible, implement web application firewall (WAF) rules blocking requests containing SQL injection signatures in the sortf parameter (regex matching SLEEP, BENCHMARK, OR, UNION keywords), though this provides only partial protection against obfuscated payloads and may cause false positives in legitimate sorting operations. Alternative workaround: temporarily disable the JoomSport plugin entirely until patching is possible, trading functionality loss for complete vulnerability elimination. Monitor WordPress access logs for sortf parameter usage with suspicious patterns (excessive length, special characters, timing anomalies) as indicators of exploitation attempts. No database structural changes required post-patching, though organizations should audit existing database contents for signs of prior unauthorized access if logs show suspicious activity pre-patch.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today