JoomSport vulnerabilities

The JoomSport plugin for WordPress up to version 5.7.9 is vulnerable to time-based SQL injection via the 'event' shortcode attribute. Insufficient escaping and lack of proper SQL query preparation allow authenticated attackers with contributor-level access or higher to append additional SQL queries.

The JoomSport plugin for WordPress up to version 5.7.8 contains an authorization bypass vulnerability. It allows authenticated attackers with subscriber-level access or higher to create arbitrary season groups and modify existing group names, participants, and round-type options. Exploitation requires obtaining the joomsportajaxnonce, which is exposed on frontend pages rendering a JoomSport shortcode.

The JoomSport plugin for WordPress up to version 5.7.8 contains a missing authorization vulnerability in the joomsport_season_groupdel() AJAX handler. It allows authenticated attackers with Subscriber-level access or higher to delete arbitrary JoomSport groups without proper capability checks.