CVE-2026-12133
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The JoomSport plugin for WordPress up to version 5.7.8 contains a missing authorization vulnerability in the joomsport_season_groupdel() AJAX handler. It allows authenticated attackers with Subscriber-level access or higher to delete arbitrary JoomSport groups without proper capability checks.
Risk Assessment
The organization is at risk of unauthorized deletion of sports group data, potentially leading to data integrity loss and disruption of leagues, teams, or other structures managed by the plugin.
Recommendation
Immediately update the JoomSport plugin to the latest available version that includes a fix for this vulnerability. If no update is available, temporarily disable the plugin or restrict AJAX function access for unauthorized users.
Other vulnerabilities in JoomSport
See all- CVE-2026-118698Medium
The JoomSport plugin for WordPress in versions up to and including 5.7.14 is vulnerable to SQL injection via the 'pgroup' parameter due to insufficient escaping and lack of query preparation. An authenticated attacker with contributor-level access or above can append additional SQL queries to extract sensitive information from the database.
- CVE-2026-118192Medium
The JoomSport plugin for WordPress is vulnerable to generic SQL Injection via the 'team_id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reached when the season has no associated joomsport_tournament term, which is the default state for newly created seasons.
- CVE-2026-13010Medium
The JoomSport plugin for WordPress up to version 5.7.9 is vulnerable to time-based SQL injection via the 'event' shortcode attribute. Insufficient escaping and lack of proper SQL query preparation allow authenticated attackers with contributor-level access or higher to append additional SQL queries.
- CVE-2026-12134Medium
The JoomSport plugin for WordPress up to version 5.7.8 contains an authorization bypass vulnerability. It allows authenticated attackers with subscriber-level access or higher to create arbitrary season groups and modify existing group names, participants, and round-type options. Exploitation requires obtaining the joomsportajaxnonce, which is exposed on frontend pages rendering a JoomSport shortcode.
Original NVD description (English source)
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check in the joomsport_season_groupdel() AJAX handler, which only verifies a nonce before executing a DELETE query on attacker-supplied group IDs. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary JoomSport group records.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS