Critical · published October 3, 2025
🚨 A backdoor is wide open for attackers! The JoomSport plugin for WordPress, up to version 5.7.3, allows unauthenticated users to execute arbitrary PHP files on your server. 🔥 Think of it like having a restaurant where anyone can write their own recipe and serve it in your kitchen without your approval — that’s the kind of trust this plugin is handing out! An attacker can slip in and run any PHP code they want, potentially bypassing your access controls and compromising sensitive data. This could lead to a complete takeover of your site, exposing everything from user passwords to private content — absolutely devastating!
Think of it like having a restaurant where anyone can write their own recipe and serve it in your kitchen without your approval — that’s the kind of trust this plugin is handing out! The Local File Inclusion vulnerability in the JoomSport plugin allows unauthenticated attackers to exploit the 'task' parameter, including and executing malicious .php files on the server.
An attacker can slip in and run any PHP code they want, potentially bypassing your access controls and compromising sensitive data. This could lead to a complete takeover of your site, exposing everything from user passwords to private content — absolutely devastating! Update immediately to version 5.7.4 or later to patch this vulnerability. After updating, review your uploaded files and ensure that only authorized PHP files are included in your application. Regularly audit your plugins to ensure none are left vulnerable! You've got this! With a quick update, you can fortify your defenses and keep your site safe. 🛡️