CVE-2026-13010
Received Received - Intake

Time-Based SQL Injection in JoomSport WordPress Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Wordfence

Description
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The shortcode can be embedded in posts or pages by Contributor-level users, making this exploitable by any authenticated user with at least that role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-13010
EUVD
EUVD-2026-42860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomsport joomsport to 5.7.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information stored in the database.

Since attackers need only contributor-level access, any authenticated user with this role or higher can exploit the flaw.

The impact includes potential data breaches, loss of confidentiality, and exposure of private or sensitive data.

The CVSS score of 6.5 indicates a medium severity with high confidentiality impact but no impact on integrity or availability.

Executive Summary

The JoomSport plugin for WordPress, used for managing sports teams and leagues, has a time-based SQL Injection vulnerability in its 'event' shortcode attribute in all versions up to 5.7.9.

This vulnerability arises because the plugin does not properly escape user-supplied input and fails to sufficiently prepare the SQL queries.

As a result, authenticated users with contributor-level access or higher can inject additional SQL queries through the shortcode embedded in posts or pages.

This allows attackers to extract sensitive information from the database by appending malicious SQL commands.

Compliance Impact

The vulnerability allows authenticated users with contributor-level access to perform time-based SQL Injection attacks that can extract sensitive information from the database.

This exposure of sensitive data could potentially lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized access or disclosure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13010. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart