Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.7
CVE-2026-107507: Squadeno plugin lets low-level trainers change sport details
CVE-2026-107507 · published 7 days ago
Summary
In Squadeno versions before 1.12.0, users with the basic Trainer role can edit fields they shouldn't, such as section, age group, author, password, comment settings and date for sports they manage. This can lead to unintended changes in scheduling and record keeping. Update the plugin to version 1.12.0 or later to enforce proper restrictions.
What to do
- Update unknown squadeno to version 1.12.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | squadeno | < 1.12.0 |
Original advisory text
Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit
The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.7
Low
Type
CWE-863Incorrect Authorization
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta