CVE-2026-107507 — Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit
The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the …
Published: 2026-10-11 · CVSS: 2.7 · CVSS 3.1
The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7