What is the CVSS score of EUVD-2026-36359?

EUVD-2026-36359 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 5.2%.

Which versions of JoomSport are affected by EUVD-2026-36359?

Beardev JoomSport WordPress plugin through version 5.7.7 contains a critical SQL injection vulnerability (CVSS 9.3) exploitable by unauthenticated remote attackers, creating direct risk of database…

Is there a public PoC exploit available for EUVD-2026-36359?

Yes, a public proof-of-concept exploit is available for EUVD-2026-36359. Prioritise patching immediately. EPSS: 5.2%.

How to fix or mitigate EUVD-2026-36359?

Within 24 hours: Inventory all WordPress installations using Beardev JoomSport plugin and identify instances running version 5.7.7 or earlier; assess criticality of plugin to business operations. Within 7 days: Disable or remove the plugin if operationally feasible; if critical, deploy Web Application Firewall rules to block SQL injection patterns targeting the plugin. Within 30 days: Monitor Beardev and Patchstack security advisories for patch availability; apply patch immediately upon vendor release.

JoomSport EUVD-2026-36359

| CVE-2026-42647 CRITICAL

SQL Injection (CWE-89)

2026-06-11 Patchstack

GHSA-2369-78ph-422f

SQLi Joomsport

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.1 CRITICAL

Network-reachable WordPress plugin, no auth or interaction (PR:N/UI:N/AC:L); SQLi typically yields full read and write of plugin/WordPress data (C:H/I:H), with scope unchanged within the DB context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 21:52 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection.

This issue affects JoomSport: from n/a through 5.7.7.

Articles & Coverage 1

POC CVE-2026-42647: Unauthenticated Time-Based Blind SQL Injection in JoomSport WordPress Plugin via sortf Parameter Jun 13, 2026

AnalysisAI

Blind SQL injection in Beardev JoomSport (WordPress plugin) through version 5.7.7 allows remote unauthenticated attackers to inject crafted SQL into backend database queries. The CVSS 9.3 score reflects a scope-changed impact with high confidentiality exposure and partial availability impact, and no public exploit has been identified at time of analysis though Patchstack has catalogued the issue.

Technical ContextAI

JoomSport (cpe:2.3:a:beardev:joomsport) is a WordPress plugin marketed as 'JoomSport - Sports League Results Management' used to publish league tables, fixtures, and results on WordPress sites. The root cause is CWE-89: Improper Neutralization of Special Elements used in an SQL Command, meaning user-controllable input is concatenated into SQL queries against the WordPress database (typically MySQL/MariaDB) without parameterization or proper escaping via wpdb->prepare(). Because the flaw is blind, the attacker does not see query output directly and instead infers data through boolean or time-based side channels against the wp_ tables.

RemediationAI

Upgrade JoomSport to a version newer than 5.7.7 once the vendor publishes a fix; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/joomsport-sports-league-results-management/vulnerability/wordpress-joomsport-plugin-5-7-7-sql-injection-vulnerability for the patched release number. Patch available per vendor advisory; until the fixed plugin version is deployed, compensating controls include deactivating the JoomSport plugin entirely (removes the league/results frontend functionality), placing the site behind a WAF with WordPress SQLi signatures enabled such as Patchstack or Wordfence (may produce false positives on legitimate admin queries), and restricting access to the vulnerable plugin endpoints via webserver rules or IP allowlisting (breaks public visitor access to sports content).