CVE-2026-12133 describes a missing authorization vulnerability (CWE-862) in the JoomSport WordPress plugin up to version 5.7.8. The vulnerability arises because the joomsport_season_groupdel() AJAX handler performs no capability checks and only verifies a nonce before executing a DELETE SQL query on attacker-supplied group IDs. This allows authenticated users with low privileges (Subscriber and above) to delete arbitrary group records within JoomSport, impacting data integrity. The CVSS 3.1 base score is 4.3, reflecting low attack complexity and limited impact to integrity without confidentiality or availability loss. No known exploits are reported, and no vendor patch or advisory is currently provided.

An authenticated attacker with Subscriber-level or higher access can delete arbitrary group records in the JoomSport plugin due to missing authorization checks. This impacts data integrity by allowing unauthorized deletion of group data. There is no impact to confidentiality or availability reported. The vulnerability could disrupt the normal operation of the plugin's group management features but does not allow privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to group deletions. Avoid granting Subscriber or higher privileges to untrusted users. No official patch or temporary fix is currently documented.