Executive brief
A vulnerability exists in the JoomSport plugin for WordPress, which is used to manage sports leagues and team data. An attacker with a basic user account can delete sports group records that they should not have access to. This could lead to the loss of league data and disruption of sports management activities on the website.
Technical details
The JoomSport plugin for WordPress (versions up to 5.7.8) contains a missing authorization vulnerability (CWE-862) within the joomsport_season_groupdel() AJAX handler. While the function verifies a nonce, it fails to perform a capability check to ensure the user has administrative permissions. Consequently, an authenticated attacker with Subscriber-level privileges can send a crafted AJAX request to execute a DELETE query against arbitrary group IDs. This results in the unauthorized removal of JoomSport group records from the database.
Affected products
- beardev JoomSport – for Sports: Team & League, Football, Hockey & more up to, and including, 5.7.8
Timeline
- 2026-07-01: advisory
References
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.8/includes/joomsport-shortcodes.php
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.8/includes/posts/joomsport-post-season.php
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.8/includes/posts/joomsport-post-season.php
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.8/includes/posts/joomsport-post-season.php
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/includes/joomsport-shortcodes.php
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/includes/posts/joomsport-post-season.php
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/includes/posts/joomsport-post-season.php