JoomSport WordPress Plugin CVE-2026-6929

No special conditions - remote unauthenticated exploitation against default configurations of JoomSport WordPress plugin versions ≤5.7.7. The sortf parameter is exposed in any public-facing page that renders player listings or team rosters, which are core features typically enabled by default when the plugin is activated. No administrative privileges, special WordPress configuration settings, or specific hosting environment required. Exploitation complexity is low (AC:L in CVSS) as the vulnerable parameter is directly accessible via standard HTTP requests without authentication barriers. Limiting factors: vulnerability only affects WordPress installations with JoomSport plugin actively installed and enabled (narrower attack surface than WordPress core vulnerabilities), and time-based blind injection requires multiple sequential requests to extract data, making exploitation detectable via rate-limiting or intrusion detection systems monitoring for repeated requests with timing anomalies to the same endpoint.

Real-world risk is ELEVATED despite no confirmed active exploitation. CVSS 7.5 accurately reflects severity: AV:N (exploitable from internet without local access), AC:L (straightforward exploitation against default configurations), PR:N (no authentication barrier), UI:N (no user interaction needed), resulting in High confidentiality impact. The time-based blind nature means automated exploitation is feasible though slower than error-based injection. EPSS score not provided, preventing quantitative exploitation probability assessment. Absence from CISA KEV suggests no widespread campaigns yet, but publicly available exploit code exists (Wordfence references include proof-of-concept locations in source code repository). WordPress plugins represent attractive targets due to widespread deployment and often-delayed patching by site administrators. The SSVC framework would likely rate this as 'Attend' priority: exploitation is straightforward (automatable with standard SQLMap tooling), technical impact is significant (total database compromise), and public PoC existence accelerates weaponization timeline. Primary limiting factor: requires JoomSport plugin installation (niche sports management plugin, not WordPress core), reducing total exposure compared to vulnerabilities in ubiquitous plugins.

Attacker identifies WordPress site running JoomSport plugin via passive reconnaissance (plugin detection through wp-content/plugins/ enumeration or frontend fingerprinting). Attacker crafts HTTP GET/POST request to any page rendering player lists with malicious sortf parameter containing time-based payload like 'sortf=name OR SLEEP(5)--' to confirm vulnerability. Upon observing 5-second response delay confirming SQL injection, attacker uses automated tools (SQLMap with --technique=T flag) to systematically extract wp_users table contents including administrator password hashes, email addresses, and authentication tokens. With database credentials exfiltrated, attacker escalates to full site compromise via administrator account takeover or direct database manipulation to inject malicious content, establish persistence, or pivot to hosting infrastructure.