Introduction
Unauthenticated attackers can execute arbitrary PHP code on WordPress sites running vulnerable versions of the JoomSport plugin. That puts site integrity, sensitive data, and control of the server at risk for any organization using the plugin to manage a sports league.
JoomSport is a specialized WordPress plugin from BearDev for managing sports leagues, teams, and related activities. It is less widely deployed than mainstream plugins, but it serves a niche, active community of sports organizations and clubs. BearDev has had multiple security issues in this product before, so its vulnerabilities are particularly relevant to WordPress administrators in the sports sector.
Technical Information
CVE-2025-7721 is a Local File Inclusion (LFI) vulnerability in all versions of the JoomSport plugin up to and including 5.7.3. It sits at line 74 of the class-jsport-controller.php file, where the plugin processes the task parameter from user input. The plugin does not properly validate or sanitize this parameter, so an attacker can manipulate it to include arbitrary PHP files from the server's filesystem.
If an attacker sends an HTTP request with the task parameter set to a malicious value, such as the path to a sensitive or attacker-controlled PHP file, the plugin includes and executes that file. The result can be remote code execution, bypassed access controls, and exposed sensitive data. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).
The root cause is that user-supplied input goes directly into file inclusion operations without sufficient validation. That allows directory traversal and the inclusion of unintended files, whether an attacker uploaded them or they already exist elsewhere on the server.
Patch Information
The developers have released version 5.7.4 to fix the LFI vulnerability in versions up to and including 5.7.3. The new version validates and sanitizes the task parameter more strictly. The update ensures that only authorized, expected files are included, which effectively mitigates the risk of unauthorized code execution.
In the vulnerable versions, the task parameter was insufficiently validated, so attackers could manipulate it to include arbitrary PHP files. The patch adds a whitelist of permitted tasks and uses functions like basename() to sanitize input, which prevents directory traversal attacks.
For example, the updated code includes a function that checks the task parameter against a predefined list of allowed tasks:
$allowed_tasks = array('view', 'edit', 'delete'); $task = isset($_GET['task']) ? $_GET['task'] : ''; if (in_array($task, $allowed_tasks)) { // Proceed with the task } else { // Handle unauthorized task }
Users can protect their WordPress sites from exploits targeting this vulnerability by updating to version 5.7.4.
Patch source: https://cvetodo.com/cve/CVE-2025-7721
Affected Systems and Versions
- JoomSport – for Sports: Team & League, Football, Hockey & more WordPress plugin
- All versions up to and including 5.7.3 are affected
- The vulnerability is present regardless of configuration, because unauthenticated users can reach the
taskparameter
Vendor Security History
BearDev, the developer of JoomSport, has a documented history of security issues in this plugin. Patchstack and other vulnerability databases record earlier SQL injection, broken access control, and cross-site scripting flaws. The vendor typically issues patches after disclosure, but critical flaws keep recurring, which points to persistent problems with its secure development practices. In September 2025, WordPress.org closed the plugin for a full security review, which reflects ongoing concerns about its security.
