The JoomSport WordPress plugin is affected by a time-based SQL Injection vulnerability (CWE-89) in the 'event' shortcode attribute. The flaw arises from improper neutralization of special elements in SQL commands, specifically due to insufficient escaping of user-supplied parameters and the absence of prepared statements in the SQL query construction. Authenticated users with contributor-level privileges or higher can embed the vulnerable shortcode in posts or pages, enabling them to append malicious SQL queries to extract sensitive data from the backend database. No official patch or remediation guidance has been provided as of the publication date.

An attacker with contributor-level access or higher can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure (no integrity or availability impact noted). The attack requires authenticated access with at least contributor privileges, limiting the attack surface to authorized users who can create or edit content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Avoid embedding untrusted content using the 'event' shortcode. Monitor vendor channels for updates or patches addressing this vulnerability.