Is CVE-2026-6929 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6929 being exploited in the wild.

How severe is CVE-2026-6929?

High severity, with a CVSS score of 7.5, published 13 May 2026.

Which products and versions are affected?

BearDev JoomSport Up to and including 5.7.7.

Is there a fix for CVE-2026-6929?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6929 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6929?

Check whether you run BearDev JoomSport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6929: BearDev JoomSport SQL injection in sortf parameter

CVE-2026-6929 · Severity: high · CVSS 7.5 · Published 2026-05-13

The JoomSport plugin for WordPress, which is used to manage sports leagues and team statistics, contains a security flaw that allows unauthorized individuals to access the website's database. By sending a specially crafted web request, an attacker can bypass security measures to extract sensitive information, such as user details or site configuration data. This could lead to a significant data breach or provide a foothold for further attacks on the website.

Technologies: BearDev JoomSport. Vendors: BearDev.

Quick answers

Is CVE-2026-6929 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6929 being exploited in the wild.
How severe is CVE-2026-6929?: High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?: BearDev JoomSport Up to and including 5.7.7.
Is there a fix for CVE-2026-6929?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6929 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6929?: Check whether you run BearDev JoomSport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The JoomSport plugin for WordPress is vulnerable to time-based blind SQL Injection due to insufficient escaping on the 'sortf' parameter and a lack of sufficient preparation on existing SQL queries within the class-jsport-getplayers.php and class-jsport-playerlist.php files. An unauthenticated attacker can exploit this by appending malicious SQL commands to legitimate queries via a network request. Because the vulnerability is time-based blind, the attacker can infer data from the database based on the time the server takes to respond to specific queries. This can be used to extract sensitive information, including user credentials and site metadata. The issue affects all versions up to and including 5.7.7.

Affected products

BearDev JoomSport – for Sports: Team & League, Football, Hockey & more Up to and including 5.7.7

Timeline

2026-05-13: disclosed: Initial publication of the vulnerability advisory.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.