CVE-2026-42647

Vulnerability

A blind SQL injection vulnerability exists in Beardev JoomSport, a WordPress plugin for sports league management. The issue is due to improper neutralization of special elements used in an SQL command. Versions from n/a through 5.7.7 are affected [1]. The vulnerable code path is reachable without authentication, making it available to any visitor to a site running the plugin.

Exploitation

An attacker needs only network access to the WordPress site; no authentication or special privileges are required. By crafting a malicious input in a parameter that is not properly sanitized, the attacker can inject SQL commands. Because it is a blind SQL injection, the attacker may need to observe response timing or boolean-based differences to extract data, but automation tools can easily exploit this [1].

Impact

Successful exploitation allows the attacker to directly interact with the database. This can lead to extraction of sensitive information (e.g., user credentials, private data), modification of database content, or potential elevation of privileges. The CVSS v3 score is 9.3 (Critical) and the vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in mass campaigns [1].

Mitigation

The vendor has released version 5.7.8 which resolves the vulnerability. Users must update to version 5.7.8 or later immediately [1]. For those unable to update immediately, Patchstack provides a mitigation rule that blocks attacks until the plugin is updated. The vulnerability is under active exploitation, so urgent action is recommended [1].