CVE-2026-12133: JoomSport Missing Authorization Group Deletion Vulnerability

Technical summary

CVE-2026-12133 is a Missing Authorization vulnerability (CWE-862) in the JoomSport plugin's joomsport_season_groupdel() AJAX handler. The function validates a nonce token before executing DELETE operations on group records, but fails to check whether the authenticated user has the capability to delete that specific group. An attacker with Subscriber-level WordPress access can supply arbitrary group IDs and remove them from the database. The CVSS 3.1 vector (4.3, MEDIUM) reflects network accessibility, low complexity, required low-privilege authentication, and localized integrity impact.

Business impact

For WordPress sites running JoomSport to manage sports leagues, teams, or tournaments, this vulnerability allows low-privilege account holders (such as team members or external contractors with subscriber access) to disrupt operations by deleting league structures, team groupings, or season data. Recovery requires database restoration or manual re-entry of deleted records. Sites managing multiple leagues or offering subscriber-level access to external users face the highest operational risk.

Affected systems

The JoomSport – for Sports: Team & League, Football, Hockey & more WordPress plugin is affected in all versions up to and including 5.7.8. WordPress installations with JoomSport active and at least one user account with Subscriber-level permissions or above are at risk. The vulnerability does not affect the WordPress core or other plugins.

Exploitability

Exploitation requires an authenticated WordPress account with Subscriber access or higher—a low barrier since many WordPress sites grant subscriber roles to external contributors, team members, or trial users. No user interaction or additional privilege escalation is needed; the attacker simply sends a crafted AJAX request to the vulnerable endpoint with a valid nonce and target group ID. The attack is repeatable and leaves minimal forensic traces beyond audit logs.

Remediation

Update JoomSport to a patched version that implements proper capability checks in the joomsport_season_groupdel() function. Verify the patch version against the official JoomSport plugin repository or vendor advisory. Until patching is complete, restrict Subscriber-level access to trusted users only, and consider disabling the plugin if it is not actively in use.

Patch guidance

Check the JoomSport plugin page on WordPress.org or the vendor's advisory for the earliest patched version after 5.7.8. Apply the update via the WordPress admin dashboard (Plugins > Updates) or download and install manually from the official source. Test the patch in a staging environment to confirm JoomSport functionality and data integrity remain intact. After patching, audit group deletion logs to detect any unauthorized deletions that may have occurred during the exposure window.

Detection guidance

Monitor WordPress audit logs and database transaction logs for DELETE queries on JoomSport group tables initiated by Subscriber-level or unexpected accounts. Review AJAX request logs for calls to joomsport_season_groupdel() with non-admin user agents. Enable WordPress logging plugins (e.g., Activity Log) to track group deletion events and correlate them with user accounts and timestamps. Alert on any group deletion by non-administrative users.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability merits prompt attention because it requires only basic authenticated access—many organizations inadvertently grant Subscriber roles—and enables direct data destruction with minimal complexity. It is not currently tracked as a known exploited vulnerability (KEV), but the low barrier to exploitation and direct business impact on sports management operations justify expedited patching, especially for sites with external subscriber access.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: Network-accessible AJAX endpoint (AV:N), low attack complexity (AC:L), requirement for low-privilege authentication (PR:L), no user interaction needed (UI:N), and localized impact to group data integrity (I:L) with no confidentiality or availability consequences. The score does not account for the business context—organizations managing critical league structures may assign higher internal risk ratings.

Frequently asked questions