EUVD-2026-40887
GHSA-rqx7-vhrr-mqm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain Subscriber-level WordPress account
-
DeliveryRetrieve valid nonce from authenticated session
-
ExploitCraft AJAX POST to wp-admin/admin-ajax.php with joomsport_season_groupdel action
-
InstallSupply attacker-controlled group ID in request body
-
C2Handler validates nonce but skips capability check
-
ExecuteDELETE query executes against target group record
-
ImpactJoomSport group data permanently destroyed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress session with at minimum Subscriber-level access - the default role assigned on sites with open user registration. The attacker must also supply a valid WordPress nonce, which is obtainable by any authenticated user through standard WordPress page rendering. No special plugin configuration, elevated role, or server-side setting is required beyond the plugin being active and the attacker holding any WordPress account. Exploitation is constrained to sites where: (1) JoomSport version 5.7.8 or earlier is installed and active, and (2) the attacker can obtain a Subscriber or higher account - either via self-registration, credential stuffing, or social engineering. Sites that disable open WordPress registration and have no untrusted user accounts are not meaningfully exposed despite the network-accessible attack vector. |
| Impact | The CVSS 4.3 Medium vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) is internally consistent with the description and accurately represents the constrained impact: the attack is network-reachable with low complexity, but requires at minimum a Subscriber-level WordPress account (PR:L), and the consequence is limited to integrity degradation of sports group records with no confidentiality or availability impact. This is not a critical-priority vulnerability for most environments. The vulnerability is absent from CISA KEV and no public exploit code has been identified, making opportunistic mass exploitation unlikely. The practical risk concentrates on sites that permit open WordPress registration and run JoomSport version 5.7.8 or earlier - a narrower population than the raw CVSS might suggest. Sites with closed registration or where all subscriber accounts are trusted personnel face negligible real-world exposure. |
| Exploit ScenarioDerived | An attacker registers a free subscriber account on a public-facing sports club or league website running JoomSport 5.7.8, then obtains a valid WordPress nonce from the authenticated session context. The attacker sends a crafted AJAX POST request to wp-admin/admin-ajax.php with the action parameter set to joomsport_season_groupdel and an arbitrary group ID, causing the plugin to execute an unguarded DELETE query that permanently removes the targeted group record. No public exploit code has been identified, but the attack is trivially constructable from the publicly visible plugin source code in the WordPress SVN repository. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Arbitrary group deletion in the JoomSport WordPress plugin (versions ≤5.7.8) is achievable by any authenticated subscriber-level user due to a missing capability check in the joomsport_season_groupdel() AJAX handler. The handler validates a WordPress nonce - preventing CSRF - but never calls current_user_can() or equivalent, allowing any logged-in user to supply attacker-controlled group IDs to an unguarded DELETE query. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; real-world risk is bounded by the requirement for a valid WordPress account and the limited scope of impact (group record deletion only).
RemediationAI
Upstream fix available (SVN changeset revision 3581673 committed to the WordPress plugin repository trunk); however, the exact released patched version number is not independently confirmed in the provided data - administrators should update the JoomSport plugin to the latest version available in the WordPress plugin directory and verify the version exceeds 5.7.8. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/03122c29-4ca5-426a-8240-74ce96dd21f2 should be consulted for confirmed fix version once published. As a compensating control prior to patching, disable open user registration on any WordPress site running JoomSport (Settings → General → uncheck 'Anyone can register'), which eliminates the PR:L attack surface entirely for externally-facing sites. Temporarily deactivating the JoomSport plugin also neutralizes the vulnerability with the trade-off of disabling all plugin functionality. Do not rely on nonce-only validation as a security control - it is insufficient.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JoomSport is a WordPress plugin by BearDev for managing sports leagues, teams, and results. The vulnerable function joomsport_season_groupdel() is registered as a WordPress AJAX handler and is located in includes/posts/joomsport-post-season.php (line 296 in both the tagged 5.7.8 release and trunk). The root cause is CWE-862 (Missing Authorization): WordPress nonce verification (wp_verify_nonce) is a CSRF defense, not an access-control mechanism - it confirms that the request originated from the authenticated session but does not verify what that user is permitted to do. A proper implementation would additionally call current_user_can() with an appropriate capability (e.g., manage_options or a plugin-defined cap) before executing the DELETE query. Because the nonce is accessible to any logged-in user and the handler accepts attacker-supplied group IDs without a privilege gate, the authorization boundary is entirely absent. The CPE identifier is cpe:2.3:a:beardev:joomsport_-_for_sports:_team_&_league,_football,_hockey_&_more:*:*:*:*:*:*:*:*.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-exploitable by any authenticated subscriber with no complexity barrier; impact is integrity-only (group record deletion), with no confidentiality or availability consequence.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The JoomSport - for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check in the joomsport_season_groupdel() AJAX handler, which only verifies a nonce before executing a DELETE query on attacker-supplied group IDs. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary JoomSport group records.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB