PT-2025-40476 · WordPress · Joomsport

Michael Mazzolini · Published 2025-10-03 · Updated 2025-10-08 · CVE-2025-7721

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress versions prior to 5.7.4

Description The JoomSport plugin for WordPress is susceptible to a Local File Inclusion issue through the task parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads are permitted. The API endpoint is not explicitly mentioned. The vulnerable parameter is task.

Recommendations Update JoomSport to version 5.7.4 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-7721

Affected Products

Joomsport

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-7721 · Security Note
• https://twitter.com/CveFindCom/status/1974077860248727995 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4f3900c7-2acb-4031-9854-b0b13e172e1f?source=cve · Note
• https://twitter.com/cracbot/status/1975878895850102971 · Twitter Post
• https://twitter.com/offseq/status/1974626178066505837 · Twitter Post
• https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/sportleague/base/wordpress/classes/class-jsport-controller.php#L74 · Note
• https://plugins.trac.wordpress.org/changeset/3371353 · Note
• https://twitter.com/0dayPublishing/status/1974076746610712835 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1974177663469138141 · Twitter Post