JoomSport EUVD-2026-36359

The target WordPress site must have the Beardev JoomSport plugin installed and activated at version 5.7.7 or earlier, with the vulnerable plugin endpoint reachable over HTTP/HTTPS by the attacker. Per CVSS PR:N/UI:N, no authentication and no user interaction are required, so default WordPress deployments running this plugin are exposed. Limiting factors are narrow: only sites running this specific plugin are affected, and exploitation is blind (no direct query output), so attackers must invest scanner time to extract data through inference channels.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L indicates a network-reachable, low-complexity, unauthenticated attack with scope change and high confidentiality impact - a realistic priority for any WordPress site running the plugin. Patchstack catalogues the issue but no KEV listing and no EPSS score were provided in the input, so widespread automated exploitation cannot be confirmed; however, WordPress plugin SQLi flaws are routinely weaponised by mass scanners once disclosed. The I:N rating is notable - the CVSS authors judged that injection cannot modify data, which is unusual for SQLi and may understate risk if write-capable queries are reachable; defenders should treat this as a high-priority patching item regardless.

An unauthenticated attacker scans WordPress sites for the JoomSport plugin, then sends a crafted HTTP GET or POST request to a vulnerable plugin endpoint embedding a blind SQL payload (boolean or time-based) into a parameter consumed by an unsanitised query. By iterating queries and observing response differences or delays, the attacker exfiltrates wp_users password hashes, session tokens, or arbitrary database content. No public exploit identified at time of analysis, but the low complexity and unauthenticated vector make weaponisation straightforward once the vulnerable parameter is identified.