The vulnerability resides in the JoomSport WordPress plugin of beardev, allowing attackers to inject arbitrary SQL through the 'order' request parameter whenever a non‑empty 'orderby' value is present. Because the plugin builds the SQL query without proper escaping or prepared statements, an authenticated administrator (or higher) can append additional statements that read sensitive database information. The absence of CSRF protection on the GET request means an attacker could also trick a logged‑in admin into executing the payload even if the attacker is unauthenticated.

All releases of the beardev JoomSport – for Sports: Team & League, Football, Hockey & more plugin up to and including version 5.7.9 are affected.

The CVSS score of 4.9 indicates moderate impact. EPSS is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker either possess administrator privileges or successfully manipulate an administrator into issuing the crafted GET request via CSRF. The combination of authentication requirement, need for specific query parameters, and lack of widespread public exploitation suggests the risk is moderated but warrants prompt attention for sites handling sensitive sport‑related data.