EUVD-2026-36359
GHSA-2369-78ph-422f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Network-reachable WordPress plugin, no auth or interaction (PR:N/UI:N/AC:L); SQLi typically yields full read and write of plugin/WordPress data (C:H/I:H), with scope unchanged within the DB context.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection.
This issue affects JoomSport: from n/a through 5.7.7.
Articles & Coverage 1
AnalysisAI
Blind SQL injection in Beardev JoomSport (WordPress plugin) through version 5.7.7 allows remote unauthenticated attackers to inject crafted SQL into backend database queries. The CVSS 9.3 score reflects a scope-changed impact with high confidentiality exposure and partial availability impact, and no public exploit has been identified at time of analysis though Patchstack has catalogued the issue.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the Beardev JoomSport plugin installed and activated at version 5.7.7 or earlier, with the vulnerable plugin endpoint reachable over HTTP/HTTPS by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L indicates a network-reachable, low-complexity, unauthenticated attack with scope change and high confidentiality impact - a realistic priority for any WordPress site running the plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker scans WordPress sites for the JoomSport plugin, then sends a crafted HTTP GET or POST request to a vulnerable plugin endpoint embedding a blind SQL payload (boolean or time-based) into a parameter consumed by an unsanitised query. By iterating queries and observing response differences or delays, the attacker exfiltrates wp_users password hashes, session tokens, or arbitrary database content. … |
| Remediation | Upgrade JoomSport to a version newer than 5.7.7 once the vendor publishes a fix; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/joomsport-sports-league-results-management/vulnerability/wordpress-joomsport-plugin-5-7-7-sql-injection-vulnerability for the patched release number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress installations using Beardev JoomSport plugin and identify instances running version 5.7.7 or earlier; assess criticality of plugin to business operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today