The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress suffers from a Local File Inclusion flaw in all releases up to 5.7.3, allowing an unauthenticated attacker to supply a crafted request that causes the application to include and execute PHP files from the server. This vulnerability aligns with CWE-98 and provides the attacker with the ability to execute arbitrary PHP code, bypass authentication, exfiltrate data, or compromise the entire WordPress installation.

Any WordPress site using the JoomSport plugin version 5.7.3 or earlier is affected. The flaw resides in the plugin’s controller code that processes the `task` parameter without proper validation, enabling inclusion of local server files when the vulnerable command is called.

The CVSS score of 9.8 marks this flaw as critical. The EPSS score is less than 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the attack does not require authentication and can execute arbitrary code, the potential impact remains severe. An attacker can construct a request containing the vulnerable `task` parameter and point it at any readable PHP file, causing that code to run under the web server’s privileges.