Description
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check in the joomsport_season_groupdel() AJAX handler, which only verifies a nonce before executing a DELETE query on attacker-supplied group IDs. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary JoomSport group records.
Published: 2026-07-01
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The JoomSport plugin for WordPress contains a missing authorization check in the joomsport_season_groupdel AJAX handler, allowing a user with Subscriber-level access or higher to delete arbitrary group records by supplying a group ID; this results in loss of data associated with those groups and potentially disrupts league or team functions.

Affected Systems

The vulnerability affects beardev’s JoomSport plugin for Sports: Team & League, Football, Hockey & more, in all versions up to and including 5.7.8; any WordPress site using those plugin versions is impacted.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, and the flaw requires only authentication with at least Subscriber privileges, with no special privileges needed. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified, and the weakness is not listed in the CISA KEV catalog. Once authenticated, an attacker can repeatedly issue requests to the season_groupdel endpoint to delete any group record specified by the attacker, leading directly to data loss.

Generated by OpenCVE AI on July 1, 2026 at 13:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the JoomSport plugin to version 5.7.9 or later, which adds the missing capability check to the AJAX handler.
  • If an upgrade is not immediately possible, either remove the subscriber role's capability to delete groups or explicitly modify that role so it lacks the capability to perform group deletions.
  • Block or disable the season_groupdel AJAX endpoint at the server or WordPress level (e.g., with a security plugin or web application firewall) to prevent any deletion attempts.

Generated by OpenCVE AI on July 1, 2026 at 13:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Beardev
Beardev joomsport – For Sports: Team & League, Football, Hockey & More
Wordpress
Wordpress wordpress
Vendors & Products Beardev
Beardev joomsport – For Sports: Team & League, Football, Hockey & More
Wordpress
Wordpress wordpress

Wed, 01 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Description The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check in the joomsport_season_groupdel() AJAX handler, which only verifies a nonce before executing a DELETE query on attacker-supplied group IDs. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary JoomSport group records.
Title JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Beardev Joomsport – For Sports: Team & League, Football, Hockey & More
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-01T10:42:12.169Z

Reserved: 2026-06-12T15:32:16.073Z

Link: CVE-2026-12133

cve-icon Vulnrichment

Updated: 2026-07-01T10:33:59.521Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T15:15:03Z

Weaknesses