CVE-2025-7721: JoomSport WordPress Plugin RCE Vulnerability

CVE-2025-7721 Overview

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 5.7.3. The vulnerability exists in the task parameter, which allows unauthenticated attackers to include and execute arbitrary .php files on the server. This can lead to execution of arbitrary PHP code, bypassing access controls, obtaining sensitive data, or achieving full remote code execution when combined with file upload capabilities.

Critical Impact

Unauthenticated attackers can achieve remote code execution by exploiting the Local File Inclusion vulnerability through the task parameter, potentially leading to complete WordPress site compromise.

Affected Products

• JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress versions up to and including 5.7.3
• WordPress installations running vulnerable JoomSport plugin versions
• Websites with file upload functionality that can be chained with this LFI vulnerability

Discovery Timeline

• October 3, 2025 - CVE-2025-7721 published to NVD
• October 6, 2025 - Last updated in NVD database

Technical Details for CVE-2025-7721

Vulnerability Analysis

This Local File Inclusion (LFI) vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The vulnerability resides in the class-jsport-controller.php file within the JoomSport plugin's controller class. The task parameter is not properly sanitized before being used in a file include operation, allowing attackers to manipulate the parameter to include arbitrary PHP files from the server's filesystem.

The vulnerability is particularly dangerous because it requires no authentication (no privileges required) and can be exploited remotely over the network with low attack complexity and no user interaction. When successfully exploited, the vulnerability impacts confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of the task parameter before it is used in a PHP include statement. The controller class fails to properly validate that the included file path is within expected boundaries, allowing attackers to traverse directories and include arbitrary PHP files. This is a classic case of trusting user-supplied input without adequate security controls.

Attack Vector

The attack is conducted over the network against WordPress sites running the vulnerable JoomSport plugin. An attacker can craft a malicious HTTP request that manipulates the task parameter to include arbitrary PHP files. The attack flow typically follows these steps:

1. Reconnaissance: Attacker identifies a WordPress site running the vulnerable JoomSport plugin version
2. Parameter Manipulation: The attacker crafts a request with a malicious task parameter containing path traversal sequences
3. File Inclusion: The vulnerable code includes the attacker-specified PHP file without proper validation
4. Code Execution: If the attacker can upload a malicious PHP file (via another vulnerability or feature) or include an existing sensitive file, arbitrary code execution is achieved

The vulnerability can be chained with file upload functionality to achieve full remote code execution. Even without file upload access, attackers may include configuration files to extract database credentials or other sensitive information.

Detection Methods for CVE-2025-7721

Indicators of Compromise

• Unusual HTTP requests to JoomSport plugin endpoints containing path traversal sequences (e.g., ../, ..%2f) in the task parameter
• Access logs showing requests to class-jsport-controller.php with unexpected or malicious parameter values
• Web server error logs indicating attempts to include files outside the plugin directory
• Unexpected PHP file executions or new PHP files appearing in upload directories

Detection Strategies

• Monitor web server access logs for requests containing path traversal patterns targeting JoomSport plugin endpoints
• Implement Web Application Firewall (WAF) rules to detect and block LFI attack patterns in request parameters
• Deploy file integrity monitoring on WordPress installations to detect unauthorized file modifications
• Use security plugins that can detect and alert on suspicious plugin behavior

Monitoring Recommendations

• Enable detailed WordPress debug logging to capture plugin-related errors and suspicious activity
• Configure SIEM rules to correlate multiple failed LFI attempts from the same source IP
• Monitor for unusual process executions originating from the web server user account
• Set up alerts for new PHP file creation in WordPress upload directories

How to Mitigate CVE-2025-7721

Immediate Actions Required

• Update the JoomSport plugin to a patched version immediately (versions after 5.7.3)
• If immediate patching is not possible, temporarily disable the JoomSport plugin until a secure version can be deployed
• Review web server logs for any signs of exploitation attempts
• Audit WordPress user accounts and permissions for any unauthorized changes
• Consider implementing a Web Application Firewall (WAF) with LFI protection rules

Patch Information

A security patch is available through the WordPress plugin repository. The fix is documented in WordPress Plugin Changeset 3371353. Site administrators should update to the latest version of the JoomSport plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository. For technical details on the vulnerable code, see the WordPress Plugin Code Review. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Implement server-level open_basedir restrictions to limit PHP file inclusion to specific directories
• Deploy a Web Application Firewall (WAF) with rules to block path traversal attempts in request parameters
• Restrict network access to the WordPress admin and plugin directories using .htaccess or server configuration
• Consider using PHP's disable_functions directive to limit dangerous functions if the plugin functionality is not critical

# Apache .htaccess example to restrict access to plugin directory
<Directory "/var/www/html/wp-content/plugins/joomsport-sports-league-results-management">
    <FilesMatch "\.php$">
        Order Deny,Allow
        Deny from all
        Allow from 127.0.0.1
    </FilesMatch>
</Directory>