PT-2026-5886 · WordPress · Sportspress

Published 2026-02-04 · Updated 2026-02-09 · CVE-2025-15368

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SportsPress plugin for WordPress versions through 2.7.26

Description The SportsPress plugin for WordPress is susceptible to Local File Inclusion via the 'template name' attribute within shortcodes. This allows authenticated attackers with contributor-level permissions or higher to include and execute arbitrary files on the server. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if PHP files can be uploaded and included. The vulnerable parameter is template name.

Recommendations Versions prior to 2.7.27 are affected. Update to a version later than 2.7.26.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-15368

Affected Products

Sportspress

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-15368 · Security Note
• https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php#L182 · Note
• https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php#L32 · Note
• https://twitter.com/TheHackerWire/status/2019054226639626512 · Twitter Post
• https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/sp-core-functions.php#L68 · Note
• https://twitter.com/VulmonFeeds/status/2019055138728493240 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/27e40af7-5697-4482-a96d-9216886c363b?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3451661%40sportspress&new=3451661%40sportspress&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2019051165342744688 · Twitter Post
• https://twitter.com/cracbot/status/2020814993147699210 · Twitter Post
• https://t.me/CVEtracker/43718 · Telegram Post