Squadeno CVE-2026-107507

Exploitation requires an authenticated WordPress account holding the Squadeno plugin's lowest-tier Trainer role, and the attacker can only affect sports to which that account is already assigned. The specific trigger is using one of the sport-save paths where the plugin fails to re-apply its authorization checks (the restriction is enforced on some save routes but not all). Limiting factors: no anonymous access (authentication required), impact is confined to metadata fields (section, age group, author, password, comment settings, date) of assigned sports only, and the site must run Squadeno before version 1.12.0.

This is a low-priority, limited-impact issue despite warranting a patch. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N, base 2.7) describes a network-reachable but authenticated flaw with no confidentiality or availability impact and only low integrity impact, consistent with CWE-863 (Incorrect Authorization). There is a tension in the signals: the description states the attacker holds the LOWEST-tier Trainer role, which maps more naturally to PR:L than the PR:H in the supplied vector, so the real barrier to exploitation is lower than the 2.7 score implies. Publicly available exploit code exists (WPScan), but the vulnerability is NOT in CISA KEV and no EPSS probability was provided in the input, so there is no evidence of active or widespread exploitation - POC availability must not be conflated with active exploitation. The net effect is a limited horizontal/privilege issue: a Trainer can alter metadata (section, age group, author, password, comment settings, date) of sports they are already assigned to, rather than achieve account takeover or data exfiltration. Priority is low - real but bounded, exploitable only by existing authenticated low-tier users against a niche plugin.

An attacker who already holds a low-tier Trainer account on a WordPress site running the Squadeno plugin before 1.12.0 uses an alternate, unguarded save path to modify restricted fields of a sport they are assigned to - such as reassigning the author or changing the password and comment settings. Publicly available exploit details exist via WPScan, documenting the unguarded save method. Exploitation is network-based with low complexity but requires valid authentication, so it cannot be performed by anonymous visitors.