CVE-2025-7721

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7721", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-16T16:45:22.676Z", "datePublished": "2025-10-03T11:17:11.999Z", "dateUpdated": "2026-04-08T16:51:58.867Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:58.867Z"}, "affected": [{"vendor": "beardev", "product": "JoomSport \u2013 for Sports: Team & League, Football, Hockey & more", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.7.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The JoomSport \u2013 for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3900c7-2acb-4031-9854-b0b13e172e1f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/sportleague/base/wordpress/classes/class-jsport-controller.php#L74"}, {"url": "https://plugins.trac.wordpress.org/changeset/3371353/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-10-02T22:17:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T18:09:18.292322Z", "id": "CVE-2025-7721", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:09:35.655Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7721", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-03T18:09:18.292322Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:09:30.416Z"}}], "cna": {"title": "JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "beardev", "product": "JoomSport \u2013 for Sports: Team & League, Football, Hockey & more", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.7.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:17:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3900c7-2acb-4031-9854-b0b13e172e1f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/sportleague/base/wordpress/classes/class-jsport-controller.php#L74"}, {"url": "https://plugins.trac.wordpress.org/changeset/3371353/"}], "descriptions": [{"lang": "en", "value": "The JoomSport \u2013 for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:58.867Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7721", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:58.867Z", "dateReserved": "2025-07-16T16:45:22.676Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:11.999Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "JoomSport \u2013 for Sports: Team & League, Football, Hockey & more", "vendor": "beardev", "versions": [{"lessThanOrEqual": "5.7.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The JoomSport \u2013 for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}, {"lang": "es", "value": "El plugin JoomSport - for Sports: Team & League, Football, Hockey & more para WordPress es vulnerable a la inclusi\u00f3n local de ficheros en todas las versiones hasta la 5.7.3, ambas inclusive, a trav\u00e9s del par\u00e1metro task. Esto hace posible que atacantes no autenticados incluyan y ejecuten ficheros .php arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde se puedan subir e incluir tipos de ficheros .php."}], "id": "CVE-2025-7721", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7721", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T18:09:18.292322Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:44.640", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/trunk/sportleague/base/wordpress/classes/class-jsport-controller.php#L74"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3371353/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3900c7-2acb-4031-9854-b0b13e172e1f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:37:21.125988+00:00", "value": {"mitigation_remediation": ["Upgrade the JoomSport plugin to any version newer than 5.7.3, which removes the vulnerable task handling logic.", "If an upgrade cannot be performed immediately, deactivate or uninstall the JoomSport plugin to eliminate the attack surface.", "Configure WordPress file permissions to disallow execution of PHP files in directories where user\u2011uploaded or plugin files reside, and ensure the `allow_url_include` setting is disabled."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution via Local File Inclusion"}, "threat_synthesis": {"affected_systems": "Any WordPress site using the JoomSport plugin version 5.7.3 or earlier is affected. The flaw resides in the plugin\u2019s controller code that processes the `task` parameter without proper validation, enabling inclusion of local server files when the vulnerable command is called.", "description_and_impact": "The JoomSport \u2013 for Sports: Team & League, Football, Hockey & more plugin for WordPress suffers from a Local File Inclusion flaw in all releases up to 5.7.3, allowing an unauthenticated attacker to supply a crafted request that causes the application to include and execute PHP files from the server. This vulnerability aligns with CWE-98 and provides the attacker with the ability to execute arbitrary PHP code, bypass authentication, exfiltrate data, or compromise the entire WordPress installation.", "risk_and_exploitability": "The CVSS score of 9.8 marks this flaw as critical. The EPSS score is less than 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nevertheless, because the attack does not require authentication and can execute arbitrary code, the potential impact remains severe. An attacker can construct a request containing the vulnerable `task` parameter and point it at any readable PHP file, causing that code to run under the web server\u2019s privileges."}}}}, "created": "2025-10-06T14:42:53.371867+00:00", "updated": "2026-04-21T02:45:25.946865+00:00", "vendors": ["beardev", "beardev$PRODUCT$joomsport", "wordpress", "wordpress$PRODUCT$wordpress"]}