The vulnerability is a time‑based blind SQL injection that can be triggered by supplying a specially crafted value for the ‘sortf’ parameter in the JoomSport WordPress plugin. The plugin fails to properly escape user input and does not prepare the underlying SQL statement, which allows an unauthenticated attacker to append additional SQL statements. Successful exploitation lets the attacker read confidential database contents, potentially including user data, site configuration, or other sensitive information.

This flaw resides in the "JoomSport – for Sports: Team & League, Football, Hockey & more" plugin developed by beardev, and it affects every released version of the plugin up to and including version 5.7.7. WordPress sites that have not upgraded past 5.7.7 are vulnerable.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, but the lack of authentication combined with the ability to inject arbitrary SQL queries presents a realistic risk. An attacker can craft HTTP requests targeting the ‘sortf’ parameter, triggering the injection remotely without needing credentials. Because the vulnerability is exploitable from the public web interface, if the site is accessible over the internet and the plugin is active, exploitation is straightforward to automate. The moderate‑to‑high risk combined with the ease of exploitation makes this a priority for remediation.