CVE-2026-12134: JoomSport WordPress Authorization Bypass

CVE-2026-12134 Overview

CVE-2026-12134 is an authorization bypass vulnerability in the JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress. The flaw affects all versions up to and including 5.7.8. The plugin fails to verify that a user is authorized to perform specific actions on season groups. Authenticated attackers with subscriber-level access or above can create arbitrary season groups or modify existing group names, participants, and round-type options. Exploitation requires obtaining the joomsportajaxnonce value, which is exposed on any frontend page rendering a JoomSport shortcode. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated attackers with minimal privileges can tamper with season group data, corrupting league and tournament content managed by the plugin.

Affected Products

JoomSport – for Sports: Team & League, Football, Hockey & more (WordPress plugin)
All versions up to and including 5.7.8
Frontend pages exposing JoomSport shortcodes

Discovery Timeline

2026-07-02 - CVE-2026-12134 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-12134

Vulnerability Analysis

The JoomSport plugin exposes AJAX endpoints that manage season group entities. These endpoints validate the request nonce but omit a capability check on the calling user. Any authenticated user, including subscribers, can therefore invoke administrative actions once they retrieve the shared nonce. The plugin embeds joomsportajaxnonce on any frontend page that renders a JoomSport shortcode, so obtaining the nonce requires only visiting a public page. Attackers can then submit crafted AJAX requests to create new season groups or modify existing group names, participant lists, and round-type options.

Root Cause

The root cause is a missing authorization check in the season group handling logic located in includes/posts/joomsport-post-season.php and referenced from includes/joomsport-shortcodes.php. The affected handlers rely solely on nonce verification and treat any authenticated request as legitimate. Because WordPress nonces are designed to prevent Cross-Site Request Forgery rather than enforce authorization, the endpoints lack the required current_user_can() capability gate.

Attack Vector

Exploitation is network-based and requires low privileges. An attacker registers or uses an existing subscriber account, then requests a frontend page that renders a JoomSport shortcode to harvest the joomsportajaxnonce. The attacker submits AJAX POST requests to the vulnerable action handlers, passing the nonce along with parameters that create or modify season groups. No user interaction is required, and no elevated role is needed on the target site. Review the relevant plugin source in joomsport-post-season.php and the shortcode handler for the vulnerable code paths.

Detection Methods for CVE-2026-12134

Indicators of Compromise

Unexpected creation or renaming of season groups in WordPress wp_posts or JoomSport custom tables outside administrator activity windows.
POST requests to admin-ajax.php with action parameters referencing JoomSport season group management from subscriber accounts.
Frontend page requests immediately followed by AJAX submissions from the same authenticated session containing joomsportajaxnonce.
Modification of participant lists or round-type configuration values without a corresponding administrator login event.

Detection Strategies

Monitor WordPress access logs for authenticated admin-ajax.php calls that originate from low-privilege users and modify JoomSport data.
Correlate WordPress audit log entries for season group changes against the roles of the acting user account.
Alert on newly registered subscriber accounts that subsequently submit JoomSport AJAX actions within a short time window.

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture creation and modification events for custom post types used by JoomSport.
Review web server logs for anomalous request rates against admin-ajax.php targeting JoomSport actions.
Track changes to plugin-managed database tables and compare them against the list of authorized administrators.

How to Mitigate CVE-2026-12134

Immediate Actions Required

Update the JoomSport plugin to a version later than 5.7.8 as soon as the vendor publishes a fixed release.
Audit existing WordPress user accounts and remove or downgrade unused subscriber-level accounts.
Review season group data for unauthorized entries and revert any changes made by non-administrator users.
Restrict user registration if the site does not require public subscriber sign-ups.

Patch Information

A plugin changeset addressing the missing authorization check is referenced in the WordPress Plugin Changeset and the Wordfence Vulnerability Report. Site administrators should apply the vendor-supplied update through the WordPress plugin manager.

Workarounds

Temporarily disable the JoomSport plugin on sites that permit open subscriber registration until a patched release is installed.
Remove JoomSport shortcodes from public pages to prevent exposure of the joomsportajaxnonce value.
Deploy a Web Application Firewall rule to block admin-ajax.php requests that invoke JoomSport season group actions from non-administrator sessions.

bash

# Example WAF rule concept: block JoomSport season group AJAX actions for non-admin roles
# Adapt the action names to those observed in your environment's request logs.
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026121340,msg:'Block JoomSport season group modification'"
  SecRule ARGS:action "@rx (?i)joomsport.*(season|group)" \
    "chain"
    SecRule REQUEST_COOKIES:/wordpress_logged_in_/ "@rx .+"