What the vulnerability does
01Description
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Explanation of Vulnerability in Simple Terms
02Summary
SportsPress versions up to 2.7.26 contain a code injection vulnerability that allows authenticated users with low privileges to execute arbitrary PHP code on the site. The vulnerability stems from improper input validation in a dynamic code execution context. An attacker with a basic user account can read sensitive data, modify site content, or take control of the installation.
What an attacker can do
03Attacker Capabilities
Execute arbitrary PHP code on the site, read sensitive data, modify content, or take full control.
Potential impact on your site
04Site Impact
Any user with basic account access can compromise your entire site and its data.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
February 4, 2026
CVE published
April 8, 2026
Record updated
