CVE-2026-11920 describes a time-based SQL Injection vulnerability in the JoomSport WordPress plugin up to version 5.7.9. The flaw exists due to improper neutralization of special elements in the 'order' parameter, allowing attackers with administrator privileges to append additional SQL queries. The affected admin page does not implement nonce or CSRF protections on the GET request, which could allow unauthenticated attackers to exploit the vulnerability by social engineering an authenticated administrator to issue a crafted request. The vulnerability triggers only when both 'order' and 'orderby' parameters are present and 'orderby' is non-empty.

An attacker with administrator-level access can exploit this vulnerability to extract sensitive information from the database via time-based SQL Injection. Due to the lack of CSRF protection, unauthenticated attackers can potentially induce an authenticated administrator to perform the malicious request, increasing the attack surface. The vulnerability does not impact data integrity or availability but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and avoid clicking on untrusted links while authenticated as an administrator. Monitor vendor channels for updates or patches addressing this vulnerability.