The JoomSport plugin for WordPress suffers from a time-based SQL Injection vulnerability (CWE-89) in all versions up to and including 5.7.9. This flaw is due to improper neutralization of special elements in the 'order' parameter combined with a non-empty 'orderby' parameter, allowing attackers with administrator privileges to append additional SQL commands to existing queries. The admin page affected does not implement nonce or CSRF protections on the GET request, which means an unauthenticated attacker can exploit this by social engineering an authenticated admin to execute a malicious request. This vulnerability can lead to unauthorized extraction of sensitive database information. No official patch or remediation guidance has been provided yet.

The vulnerability enables attackers with administrator-level privileges to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. Due to the lack of CSRF protection on the affected admin page, unauthenticated attackers can exploit this by tricking authenticated administrators into executing crafted requests. The CVSS score of 4.9 (medium severity) reflects the moderate risk, with confidentiality impact but no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and avoid clicking on untrusted links while authenticated as an administrator. Monitor for vendor updates regarding patches or official mitigations.