WP Club Manager – WordPress Sports Club Plugin < 2.2.11 - Missing Authorization to Unauthenticated Event Permalink Update

2024-02-0500:00:00

wpscan.com

wordpress

sports club

plugin

vulnerability

unauthorized modification

data

capability check

settings save

unauthenticated attackers

permalink structure

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.7%

JSON

Description The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to update the permalink structure for the clubs