CVE-2026-107507: Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit
Published Oct 11, 2026
·Updated
The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.
Affected Software
1 affected component
Squadeno Squadeno<1.12.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Squadeno WordPress pluginto a version that resolves this vulnerability.Fixed in 1.12.0
Event History
Oct 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
Description