CVE-2026-12134

Name of the Vulnerable Software and Affected Versions JoomSport – for Sports: Team & League, Football, Hockey & more versions prior to 5.7.9

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can create arbitrary season groups or modify existing group names, participants, and round-type options. This exploitation requires the joomsportajaxnonce, which is exposed on frontend pages that render a JoomSport shortcode.

Recommendations Update JoomSport – for Sports: Team & League, Football, Hockey & more to version 5.7.9 or later.