CVE-2026-11920: JoomSport WordPress Plugin SQLi Flaw

CVE-2026-11920 Overview

CVE-2026-11920 is a time-based SQL Injection vulnerability [CWE-89] in the JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress. The flaw affects all versions up to and including 5.7.9 and stems from insufficient escaping of the order GET parameter combined with an unprepared SQL query in joomsport-page-boxfields.php. Authenticated attackers with administrator-level access can append additional SQL statements to extract sensitive data from the WordPress database. Because the affected admin page lacks nonce or CSRF protection, an unauthenticated attacker can chain the flaw with social engineering to trick an administrator into issuing a crafted request. The vulnerability triggers only when the orderby parameter is also present and non-empty.

Critical Impact
Successful exploitation allows extraction of sensitive database contents, including user credentials and secrets stored in the WordPress database, when an administrator visits a crafted URL.

Affected Products

JoomSport – for Sports: Team & League, Football, Hockey & more (WordPress plugin)
All versions up to and including 5.7.9
Vulnerable file: includes/pages/joomsport-page-boxfields.php

Discovery Timeline

2026-08-05 - CVE-2026-11920 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-11920

Vulnerability Analysis

The vulnerability resides in the admin-facing box fields page of the JoomSport plugin. The plugin builds a SQL query using the order GET parameter without applying esc_sql(), sanitize_sql_orderby(), or $wpdb->prepare() with a proper placeholder. As a result, attacker-controlled input is concatenated directly into the ORDER BY clause of an existing query. Because the injection point sits in an ORDER BY clause, standard UNION-based payloads are impractical, so the vulnerability manifests as a time-based blind SQL Injection. Attackers infer data one bit at a time by observing conditional delays produced with functions such as SLEEP() or BENCHMARK().

Root Cause

The root cause is a combination of two coding defects. First, the order request parameter is interpolated into the SQL string without escaping or parameterization. Second, the surrounding query is not prepared through the WordPress $wpdb->prepare() API. The trigger condition requires the orderby parameter to be present and non-empty, so the vulnerable code path is only entered when both parameters appear in the request.

Attack Vector

Exploitation requires the request to originate from a session with administrator privileges. However, the admin page performs no nonce or CSRF check on the GET request. An unauthenticated attacker can therefore host a malicious page that causes an administrator's browser to issue the crafted request in the background, converting the flaw into a one-click, cross-site attack. Successful exploitation returns query results indirectly through timing side channels, enabling exfiltration of database contents such as password hashes, session tokens, and API keys stored by other plugins.

See the Wordfence Vulnerability Analysis and the vulnerable source at JoomSport Page Boxfields Code (line 35) for technical details.

Detection Methods for CVE-2026-11920

Indicators of Compromise

Requests to wp-admin pages tied to JoomSport containing both order and orderby query parameters with unusual values.
Presence of SQL time-delay functions such as SLEEP(, BENCHMARK(, or WAITFOR DELAY in URL-decoded query strings.
Anomalously long response times for GET requests to JoomSport admin endpoints, often several seconds or more.
Outbound HTTP referrers from unknown external sites immediately preceding administrator-issued admin-page requests.

Detection Strategies

Inspect web server access logs for JoomSport admin URLs where the order parameter contains SQL keywords, parentheses, or comment sequences like --.
Correlate elevated request latency with the presence of the order parameter on JoomSport admin routes.
Use a Web Application Firewall (WAF) with SQL Injection signatures to flag suspicious ORDER BY payloads.

Monitoring Recommendations

Monitor WordPress audit logs for administrator sessions issuing repeated similar requests to the same JoomSport admin page.
Track database query duration metrics for the WordPress database and alert on statistical outliers.
Alert on administrator browsers navigating to the affected admin page from external referrers.

How to Mitigate CVE-2026-11920

Immediate Actions Required

Update the JoomSport plugin to a version later than 5.7.9 as soon as a patched release is available.
Restrict administrator access to trusted networks and require re-authentication for administrative sessions.
Deploy a WAF rule blocking ORDER BY payloads containing SQL keywords on JoomSport plugin endpoints.
Instruct administrators not to browse untrusted sites while authenticated to the WordPress admin console.

Patch Information

The vendor addressed the vulnerable code in the plugin repository. Review the JoomSport Changeset Update for the exact code changes applied to joomsport-page-boxfields.php. Confirm the installed plugin version reports higher than 5.7.9 before considering the site remediated.

Workarounds

Temporarily deactivate the JoomSport plugin until a patched release is installed.
Enforce an allowlist at the WAF for the order parameter accepting only values asc and desc.
Require administrators to use browser isolation or a dedicated management browser profile to reduce CSRF risk.

bash

# Example WAF rule (ModSecurity) restricting the 'order' parameter on JoomSport admin pages
SecRule REQUEST_URI "@contains joomsport-page-boxfields" \
  "chain,deny,status:403,id:1029211920,msg:'CVE-2026-11920 JoomSport SQLi attempt'"
  SecRule ARGS:order "!@rx ^(asc|desc)$" "t:none,t:lowercase"