Squadeno
Monthly
Authenticated users with the lowest-tier Trainer role in the Squadeno WordPress plugin before 1.12.0 can modify metadata of sports they are assigned to-section, age group, author, password, comment settings, and date-by exploiting a save path that does not re-apply the plugin's authorization restrictions. This is an incorrect authorization flaw (CWE-863) with a low CVSS base score of 2.7, and publicly available exploit code exists, though no active exploitation has been confirmed. Upgrading to version 1.12.0 resolves the issue.
Authenticated users with the lowest-tier Trainer role in the Squadeno WordPress plugin before 1.12.0 can modify metadata of sports they are assigned to-section, age group, author, password, comment settings, and date-by exploiting a save path that does not re-apply the plugin's authorization restrictions. This is an incorrect authorization flaw (CWE-863) with a low CVSS base score of 2.7, and publicly available exploit code exists, though no active exploitation has been confirmed. Upgrading to version 1.12.0 resolves the issue.