CVE-2026-42647: WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability

Synopsis

SQL injection in the JoomSport WordPress plugin (versions up to and including 5.7.7) allows an unauthenticated remote attacker to send crafted HTTP requests directly to the affected WordPress site. No login or user interaction is required. Successful exploitation exposes the full WordPress database to blind SQL injection reads, giving the attacker access to stored credentials, session tokens, and all application data, with secondary potential to disrupt database availability. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as the upstream maintainer releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress site over the network; the vulnerable plugin endpoint is exposed via standard HTTP/HTTPS, so any internet-facing deployment is reachable without any special network position.

• AuthenticationNot required

  No account or session token is needed; the injection point is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker sends crafted requests directly to the server; no user action or click is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable with no dependency on race conditions, memory layout, or other environmental factors.

Blast Radius

• Reads any data stored in the WordPress database using blind SQL injection techniques, including usernames, hashed passwords, and email addresses for all registered users.
• Extracts active session tokens and authentication secrets (such as WordPress secret keys and salts if stored in the database), enabling account takeover without knowing user passwords.
• Reads custom plugin and application data tables, which may include personally identifiable information, order records, or sports league data managed by JoomSport.
• Causes availability disruption to the database layer through resource-intensive blind injection queries, degrading or crashing the affected WordPress service.