Junglewise Threat Intelligence

CVE-2026-6929: BearDev JoomSport SQL injection in sortf parameter

CVE-2026-6929 · Severity: high · CVSS 7.5 · Published 2026-05-13

Technologies: BearDev JoomSport. Vendors: BearDev.

Executive brief

The JoomSport plugin for WordPress, which is used to manage sports leagues and team statistics, contains a security flaw that allows unauthorized individuals to access the website's database. By sending a specially crafted web request, an attacker can bypass security measures to extract sensitive information, such as user details or site configuration data. This could lead to a significant data breach or provide a foothold for further attacks on the website.

Technical details

The JoomSport plugin for WordPress is vulnerable to time-based blind SQL Injection due to insufficient escaping on the 'sortf' parameter and a lack of sufficient preparation on existing SQL queries within the class-jsport-getplayers.php and class-jsport-playerlist.php files. An unauthenticated attacker can exploit this by appending malicious SQL commands to legitimate queries via a network request. Because the vulnerability is time-based blind, the attacker can infer data from the database based on the time the server takes to respond to specific queries. This can be used to extract sensitive information, including user credentials and site metadata. The issue affects all versions up to and including 5.7.7.

Affected products

  • BearDev JoomSport – for Sports: Team & League, Football, Hockey & more Up to and including 5.7.7

Timeline

  • 2026-05-13: disclosed: Initial publication of the vulnerability advisory.

References

Related threats