The JoomSport – for Sports: Team & League

CVE-2026-12133 is a Missing Authorization flaw (CWE-862) in the *JoomSport – Sports: Team & League, Football, Hockey & more* WordPress plugin. The vulnerable code path fails to enforce a capability or nonce check on a handler that mutates plugin-managed data (teams, matches, seasons, or similar). Any authenticated user at Subscriber level or above — the default role WordPress hands out with users_can_register on — can invoke it and cause an unauthorized write. Vendor CVSS is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N: network-reachable, low complexity, low privileges, no confidentiality or availability impact, and only *partial* integrity impact scoped to the plugin's own tables.

The vendor MEDIUM (4.3) rating is generous but defensible. The vector is honest — there is genuinely no data theft, no RCE, no auth bypass, no privilege escalation to WP admin. The only thing an attacker gets is the ability to scribble on sports-league records inside a niche plugin. On a fleet of 10,000 hosts this is a LOW — closer to graffiti than compromise. We reassess down one bucket.

Why this verdict

• Authentication is a hard prerequisite. PR:L means at least a Subscriber account. Any WP site with open registration disabled (the default) blocks the chain at step 1.
• Impact is I:L and scoped to plugin tables. No RCE, no auth bypass, no WP admin escalation, no PII exfil. The worst outcome is a defaced sports scoreboard, revertable from any hourly backup.
• Role multiplier: JoomSport's canonical deployment role is a *public-facing amateur-sports-league marketing site*. There is no high-value-role variant — it is not identity, PKI, CI/CD, backup, hypervisor, EDR, network edge, or SIEM software. Blast radius stays at the single-site plugin-data level in 100% of realistic deployments. The Deployment-Role Blast Radius floor is therefore LOW, not HIGH.
• Exposure population is trivial. ~3–5k active installs per WordPress.org, near-zero enterprise footprint. A 10,000-host defender is unlikely to have a single instance.
• No in-the-wild activity, no KEV, no mass-scanner weaponization as of disclosure day.

Why not higher?

MEDIUM would require either an unauthenticated variant, a confidentiality/availability impact, or a plugin with material enterprise footprint. None apply. HIGH/CRITICAL would require role-multiplier amplification into identity, hypervisor, or edge — JoomSport has none.

Why not lower?

IGNORE is wrong because the flaw is real, remotely reachable by any logged-in user, and requires a vendor patch. It belongs in the backlog, not the bin — hence LOW, not IGNORE.

1. Set users_can_register = 0 on any WP site running JoomSport — Removes step 1 of the chain entirely. Set in Settings → General → Membership or via wp option update users_can_register 0. LOW verdict has no mitigation SLA, but this is a 30-second config change — do it opportunistically within the 365-day remediation window.
2. Deploy a Patchstack / Wordfence vPatch rule — Both vendors ship a virtual patch signature within 24h of disclosure that blocks the specific vulnerable AJAX/REST action name. Enable auto-update of firewall rules; no server reboot required. Apply within the standard 365-day remediation window.
3. Update JoomSport to the patched release via wp plugin update joomsport-sports-league-results-management — The actual fix. Because LOW has no noisgate mitigation SLA, schedule this into your normal monthly WP plugin update cadence — must land inside the 365-day noisgate remediation SLA.
4. Audit existing Subscriber accounts for dormant / suspicious registrations — If open registration was ever enabled, low-tier accounts may already exist. Run wp user list --role=subscriber --format=csv and cull accounts with no post/comment history and free-mail domains.

Run this on the WordPress host as a user with shell access and the wp (WP-CLI) binary in PATH. Invoke as ./check-cve-2026-12133.sh /var/www/html where the argument is the WordPress webroot. No elevated privileges needed beyond read access to the plugin directory.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-12133 — JoomSport WordPress plugin Missing Authorization
# Usage: ./check-cve-2026-12133.sh <wordpress-webroot>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN / not installed
set -u

WEBROOT="${1:-/var/www/html}"
PLUGIN_DIR="$WEBROOT/wp-content/plugins/joomsport-sports-league-results-management"
README="$PLUGIN_DIR/readme.txt"
# Set FIXED_VERSION per the vendor advisory published 2026-07-01.
# Update this value when the vendor confirms the patched release.
FIXED_VERSION="${FIXED_VERSION:-5.7.8}"

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN: JoomSport plugin not installed at $PLUGIN_DIR"
  exit 2
fi

if [ ! -r "$README" ]; then
  echo "UNKNOWN: cannot read $README"
  exit 2
fi

INSTALLED=$(grep -iE '^Stable tag:' "$README" | awk -F: '{print $2}' | tr -d ' \r\n')
if [ -z "$INSTALLED" ]; then
  INSTALLED=$(grep -iE '^\* Version:|Version:' "$PLUGIN_DIR"/*.php 2>/dev/null | head -n1 | sed -E 's/.*[Vv]ersion:[[:space:]]*//; s/[^0-9.].*$//')
fi

if [ -z "$INSTALLED" ]; then
  echo "UNKNOWN: could not parse plugin version"
  exit 2
fi

# semver compare: returns 0 if $1 >= $2
ver_ge() {
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

if ver_ge "$INSTALLED" "$FIXED_VERSION"; then
  echo "PATCHED: JoomSport $INSTALLED >= fixed $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE: JoomSport $INSTALLED < fixed $FIXED_VERSION (CVE-2026-12133)"
  # Bonus check: is open registration enabled? That raises effective severity.
  if command -v wp >/dev/null 2>&1; then
    REG=$(wp --path="$WEBROOT" --skip-plugins --skip-themes option get users_can_register 2>/dev/null)
    [ "$REG" = "1" ] && echo "  WARN: users_can_register=1 — public registration enabled, chain is fully reachable"
  fi
  exit 1
fi

Sources

1. Patchstack — JoomSport Broken Access Control advisory family
2. Wordfence Intelligence — WordPress plugin vulnerability feed
3. WordPress.org plugin page — JoomSport
4. MITRE CWE-862 — Missing Authorization
5. FIRST EPSS
6. CISA KEV Catalog
7. SentinelOne — related CVE-2025-7721 JoomSport RCE context
8. BitNinja — prior JoomSport SQLi context