CVE-2025-7721 is a critical Local File Inclusion vulnerability (CWE-98) in the JoomSport WordPress plugin (versions ≤ 5.7.3). The vulnerability arises from improper control of the filename used in an include/require statement via the 'task' parameter. This allows unauthenticated remote attackers to include arbitrary PHP files on the server, enabling execution of arbitrary PHP code. The vulnerability has a CVSS v3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the affected server. This can lead to bypassing access controls, unauthorized data disclosure, and full system compromise. The vulnerability affects all versions of the plugin up to 5.7.3. No known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin and consider disabling or removing it if possible. Monitor for updates from the vendor or trusted security sources for an official patch or mitigation instructions.