PT-2026-110017 · WordPress · Squadeno
CVSS v3.1
2.7
Low
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Squadeno WordPress plugin versions prior to 1.12.0
Description
Insufficient restriction enforcement during the sport saving process allows users with the lowest-tier Trainer role to modify unauthorized fields of a sport they are assigned to. Affected fields include the section, age group, author, password, comment settings, and date.
Recommendations
Update Squadeno WordPress plugin to version 1.12.0 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Squadeno