The vulnerability stems from improper neutralization of special characters in an SQL command within Beardev JoomSport, which permits blind SQL injection. An attacker can send crafted input that bypasses input validation, causing the plugin to execute arbitrary SQL queries. This can result in unauthorized access to sensitive data, modification of database records, or further compromise of the WordPress site.

The flaw affects all installations of the JoomSport WordPress plugin version 5.7.7 and earlier. It is present in the plugin shipped by Beardev and is activated on any WordPress site that has the plugin installed and enabled.

The CVSS score of 9.3 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is likely local to the WordPress environment, requiring an attacker to be able to submit input to the plugin’s interfaces. Because the exploitation path involves blind injection, an attacker may need to use timing attacks or observable side effects to extract data, but the lack of error messages does not prevent data exfiltration or modification.