{
 "id": "WPSEC-2026-2046",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2046/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2046/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2046/index.md",
 "title": "JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute",
 "description": "The JoomSport plugin for WordPress is vulnerable to SQL Injection via the 'pgroup' shortcode attribute in all versions up to, and including, 5.7.14 due to insufficient sanitization of the user-supplied value and lack of sufficient preparation of the existing SQL query, where the value is interpolated directly into the team players tab query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
 "plugin": {
  "slug": "joomsport-sports-league-results-management",
  "name": "JoomSport",
  "full_name": "JoomSport – for Sports: Team & League, Football, Hockey & more",
  "wordpress_org": "https://wordpress.org/plugins/joomsport-sports-league-results-management/",
  "advisories_url": "https://wpsec.com/vuln/plugin/joomsport-sports-league-results-management/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/joomsport-sports-league-results-management"
 },
 "type": "SQLI",
 "cwe": [
  "CWE-89"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.7.15",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.7.15"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.7.15",
 "remediation": "Update to 5.7.15 or later.",
 "fix_released": "2026-10-29T10:46:01+00:00",
 "published": "2026-10-30T10:50:10+00:00",
 "updated": "2026-10-29T17:44:13.933641+00:00",
 "also_published_as": {
  "source": "wordfence",
  "cve": [
   "CVE-2026-118698"
  ],
  "published": "2026-10-29T17:00:19+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2046/",
  "https://plugins.svn.wordpress.org/joomsport-sports-league-results-management/tags/5.7.15/",
  "https://wordpress.org/plugins/joomsport-sports-league-results-management/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/joomsport-sports-league-results-management",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-30"
 }
}