Missing authorization in beardev JoomSport – for Sports: Team & League, Football, Hockey…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check in the joomsport_season_groupdel() AJAX handler, which only verifies a nonce before executing a DELETE query on attacker-supplied group IDs. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary JoomSport group records.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12133
- 2026-10-03 Alias added: GHSA-rqx7-vhrr-mqm2
References
Other 10
- https://www.wordfence.com/threat-intel/vulnerabilities/id/03122c29-4ca5-426a-8240-74ce96dd21f2?source=cve
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/includes/posts/joomsport-post-season.php#L296
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.8/includes/posts/joomsport-post-season.php#L296
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/includes/posts/joomsport-post-season.php#L294
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.8/includes/posts/joomsport-post-season.php#L294
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/includes/posts/joomsport-post-season.php#L25
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.8/includes/posts/joomsport-post-season.php#L25
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/includes/joomsport-shortcodes.php#L473
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.8/includes/joomsport-shortcodes.php#L473
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3581673%40joomsport-sports-league-results-management&new=3581673%40joomsport-sports-league-results-management&sfp_email=&sfph_mail=
More beardev vulnerabilities
- TI-2022-03716 JoomSport < 5.2.8 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
- TI-2019-10692 The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or… CVSS 3.0CRITICAL 9.8
- TI-2026-30906 WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
- TI-2021-06676 JoomSport < 5.1.8 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
- TI-2025-07046 JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion CVSS 3.1CRITICAL 9.8
- TI-2026-06071 JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter CVSS 3.1HIGH 7.5
Sources
- CVE-2026-12133 · CVE Program
- CVE-2026-12133 · NVD
- FIRST EPSS
- GHSA-rqx7-vhrr-mqm2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences