Is CVE-2026-12133 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12133 being exploited in the wild.

How severe is CVE-2026-12133?

Medium severity, with a CVSS score of 4.3, published 1 July 2026.

Which products and versions are affected?

BearDev JoomSport up to, and including, 5.7.8.

Is there a fix for CVE-2026-12133?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12133 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12133?

Check whether you run BearDev JoomSport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12133: BearDev JoomSport missing authorization in joomsport_season_groupdel

CVE-2026-12133 · Severity: medium · CVSS 4.3 · Published 2026-07-01

A vulnerability exists in the JoomSport plugin for WordPress, which is used to manage sports leagues and team data. An attacker with a basic user account can delete sports group records that they should not have access to. This could lead to the loss of league data and disruption of sports management activities on the website.

Technologies: BearDev JoomSport. Vendors: BearDev.

Quick answers

Is CVE-2026-12133 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12133 being exploited in the wild.
How severe is CVE-2026-12133?: Medium severity, with a CVSS score of 4.3, published 1 July 2026.
Which products and versions are affected?: BearDev JoomSport up to, and including, 5.7.8.
Is there a fix for CVE-2026-12133?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12133 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12133?: Check whether you run BearDev JoomSport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The JoomSport plugin for WordPress (versions up to 5.7.8) contains a missing authorization vulnerability (CWE-862) within the joomsport_season_groupdel() AJAX handler. While the function verifies a nonce, it fails to perform a capability check to ensure the user has administrative permissions. Consequently, an authenticated attacker with Subscriber-level privileges can send a crafted AJAX request to execute a DELETE query against arbitrary group IDs. This results in the unauthorized removal of JoomSport group records from the database.

Affected products

beardev JoomSport – for Sports: Team & League, Football, Hockey & more up to, and including, 5.7.8

Timeline

2026-07-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.