CVE-2026-6929 is a high severity SQL Injection vulnerability (CWE-89) in the JoomSport WordPress plugin up to version 5.7.7. The issue arises from improper neutralization of special elements in the 'sortf' parameter, enabling unauthenticated attackers to perform time-based blind SQL Injection attacks. This vulnerability allows attackers to append malicious SQL queries to existing database queries, potentially exposing sensitive information. No official fix or patch has been published, and the plugin is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the backend database. The vulnerability does not impact integrity or availability directly but poses a significant confidentiality risk. Since the attack vector is network accessible without authentication and requires low attack complexity, the risk is elevated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor is recommended.