CVE-2026-118192 in JoomSport Plugin
Summary
by MITRE • 10/29/2026
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'team_id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reached when the season has no associated joomsport_tournament term, which is the default state for newly created seasons.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The JoomSport plugin for WordPress, a widely utilized tool for managing sports teams and leagues across various disciplines including football and hockey, contains a critical database security flaw in versions up to 5.7.11. This vulnerability manifests as an Unrestricted Upload of Functionality with Code Execution implications through SQL Injection, specifically targeting the team_id parameter within the plugin's administrative interface. The root cause lies in insufficient input sanitization and validation mechanisms when processing user-supplied data for database queries. Unlike many modern web applications that utilize prepared statements or robust escaping functions to neutralize malicious payloads, this specific code path fails to adequately prepare existing SQL queries before execution. This architectural oversight allows attackers to inject arbitrary SQL commands directly into the query structure, bypassing intended logic and manipulating the underlying database operations.
The operational impact of this vulnerability is significant due to its potential for data exfiltration and system compromise. An attacker with contributor-level access or higher privileges can exploit this flaw by crafting a malicious team_id parameter that appends additional SQL queries to legitimate requests. This capability enables the extraction of sensitive information stored in the WordPress database, such as administrator credentials, user session tokens, and other proprietary league data. The vulnerability is particularly insidious because it triggers under specific default conditions; specifically, when a newly created season lacks an associated joomsport_tournament term. Since this represents the initial state for many new seasons, the attack surface remains active by default until explicit configuration changes are made, increasing the likelihood of successful exploitation in environments where rapid deployment is prioritized over security hardening.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and falls under MITRE ATT&CK technique T1059 Command and Scripting Interpreter via database interaction or potentially T1114 Collection of Email Addresses if targeting user data. The lack of parameterized queries represents a fundamental deviation from secure coding standards recommended by OWASP for preventing injection attacks. Attackers can leverage this flaw to perform blind SQL injection, extracting data byte-by-byte without immediate feedback, which complicates detection efforts and allows for stealthy long-term access to the database infrastructure.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Administrators should immediately update the JoomSport plugin to version 5.7.12 or later where this issue has been addressed through proper input validation and query preparation mechanisms. In cases where updating is not feasible, temporary workarounds include restricting contributor-level access to trusted individuals only and ensuring that all new seasons are configured with an associated joomsport_tournament term from the outset, thereby avoiding the vulnerable code path entirely. Furthermore, implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious SQL patterns in HTTP requests before they reach the application logic. Regular security audits and adherence to secure coding practices that mandate parameterized queries for all database interactions are essential to prevent similar vulnerabilities in future development cycles.