WordPress Plugin Vulnerabilities

Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit

Description

The plugin does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.

Proof of Concept

Affects Plugins

Plugin icon
squadeno-club-sports-manager
Fixed in 1.12.0

References

CVE
CVE-2026-107507

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Doston Abdullayev
Submitter
Doston Abdullayev
Submitter website
https://github.com/justdoston
Verified
Yes
WPVDB ID
f02f3608-0809-4a4e-ae5f-5e89d42c4026

Timeline

Publicly Published
2026-10-09 (about 2 days ago)
Added
2026-10-09 (about 1 day ago)
Last Updated
2026-10-09 (about 1 day ago)

Other

Published
Title
Published
2024-06-19
Title
Depicter < 3.1.0 - Authenticated (Contributor+) Arbitrary Nonce Generation
Published
2024-07-16
Title
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin < 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload
Published
2026-07-09
Title
Fluent Forms < 6.2.2 - Subscriber+ Arbitrary Subscription Cancellation via subscription_id
Published
2025-12-16
Title
Ultimate Member < 2.11.1 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
Published
2025-09-11
Title
Recipe Card Blocks for Gutenberg & Elementor < 3.4.9 - Incorrect Authorization