Executive brief
SportsPress Pro, a WordPress plugin used for managing sports club websites, contains a security flaw that could allow an attacker with basic contributor-level access to view sensitive internal files. By exploiting this vulnerability, an attacker could potentially access configuration files containing database credentials, leading to a full compromise of the website's data and operations. At the time of this report, no official patch has been released by the developer.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ThemeBoy SportsPress Pro plugin for WordPress (versions up to and including 2.7.29). The flaw is classified under CWE-98 (Improper Control of Filename for Include/Require Statement) and stems from insufficient validation of user-supplied input used in file inclusion functions. An attacker with 'Contributor' or higher privileges can exploit this to include and execute local files on the server. This can lead to the disclosure of sensitive information, such as the wp-config.php file, potentially resulting in full database access or remote code execution if combined with other techniques. As of the advisory date, no official patch is available.
Affected products
- ThemeBoy SportsPress Pro <= 2.7.29
Timeline
- 2026-02-14: disclosed: Reported by w41bu1
- 2026-07-02: advisory: Published by Patchstack and NVD