{"schema":"threatline.record/2","record":{"id":"CVE-2026-107507","aliases":[],"summary":"Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit","details":"The Squadeno  WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.","categories":["Unclassified"],"product":"Squadeno","vendor":"Unknown","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107507","source_modified_at":"2026-10-11T11:32:46.886Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Squadeno","vendor":"Unknown","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"1.12.0"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107507","source_modified_at":"2026-10-11T11:32:46.886Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Squadeno","ecosystem":null},"version":"1.12.0","basis":"first unaffected version stated in the CVE record"}],"cvss":2.7,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00205,"percentile":0.09942,"score_date":"2026-10-23"},"published_at":"2026-10-11T06:00:09.945Z","modified_at":"2026-10-11T11:32:46.886Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107507","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-11T11:32:46.886Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107507","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://wpscan.com/vulnerability/f02f3608-0809-4a4e-ae5f-5e89d42c4026/","tags":["exploit","vdb-entry","technical-description"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-11T11:28:41.810809Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T11:32:46.886Z","content_hash":"6c6fdf7dce6b989ec07edf0bf54644ca5b9898c2e572d8c438924142bb935c7e"}}