What is the CVSS score of EUVD-2026-53289?

EUVD-2026-53289 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

JoomSport EUVD-2026-53289

| CVE-2026-11920 MEDIUM

SQL Injection (CWE-89)

2026-08-05 Wordfence

GHSA-x38f-3fqc-wvp8

WordPress SQLi CSRF Wordpress Plugin Joomsport For Sports Beardev

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

CSRF path enables unauthenticated exploitation (PR:N) but requires admin user interaction (UI:R); impact is confidentiality-only database read (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 08:40 vuln.today

CVE Published

Aug 05, 2026 - 07:39 nvd

MEDIUM 4.9

DescriptionCVE.org

The JoomSport - for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The affected admin page lacks nonce or CSRF protection on the GET request, meaning an unauthenticated attacker could exploit this vulnerability by tricking an authenticated administrator into issuing a crafted request. Additionally, the vulnerability is only triggered when the 'orderby' parameter is also present and non-empty alongside the 'order' parameter.

AnalysisAI

Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.

Technical ContextAI

CWE-89 (SQL Injection) arises in the plugin's admin boxfields page (includes/pages/joomsport-page-boxfields.php, lines 35-36) where the user-supplied 'order' GET parameter is concatenated into a SQL ORDER BY clause without adequate escaping or use of WordPress prepared statements ($wpdb->prepare()). The injection is time-based blind, meaning the attacker cannot read results directly but infers data by measuring database response delays. A critical compounding weakness is the absence of WordPress nonce verification on the GET handler - a standard CSRF defense in WordPress admin pages - which removes the credential barrier for a CSRF-assisted attack path. The affected CPE is cpe:2.3:a:beardev:joomsport_-_for_sports:_team_&_league,_football,_hockey_&_more:*:*:*:*:*:*:*:* covering all versions up to and including 5.7.9. The plugin is a sports league and team management tool for WordPress sites.

RemediationAI

A code fix has been committed to the plugin's WordPress SVN trunk (changeset revision 3594276, visible at the WordPress plugin repository changeset link in the references), but the exact released patched version number is not independently confirmed from the available data - administrators should update the plugin to the latest available version in the WordPress plugin directory and verify it is beyond 5.7.9. As an immediate compensating control, restrict access to the wp-admin interface to trusted IP ranges using server-level controls (e.g., nginx allow/deny directives or .htaccess), which mitigates both the authenticated and CSRF-mediated attack paths by preventing untrusted network access to the admin endpoint. If IP restriction is not feasible, consider temporarily deactivating the JoomSport plugin until the patched version is confirmed and installed. Note that deactivation disrupts sports league functionality. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ffc2fe31-9bc2-497a-a8f4-1bc4f93de5a2 should be monitored for confirmed fixed-version information.