The Squadeno WordPress plugin prior to version 1.12.0 fails to enforce its restriction policies when a sport record is saved through the Quick Edit interface, allowing any user with the Trainer role or lower to modify key fields, including section, age group, author, password, comment settings, and date. This unauthorized data modification can lead to incorrect scheduling, misrepresentation of participant data, and overall corruption of the sports system, but does not provide remote code execution or other higher‑level capabilities.

Installations of the Squadeno plugin with versions earlier than 1.12.0 on WordPress sites are impacted. The vulnerability applies to any site where users are granted the Trainer role or less.

An attacker must possess a WordPress account with the Trainer role or lower and access to the Quick Edit feature. Once these prerequisites are met, the flaw is straightforward to exploit because the plugin does not perform the required access control checks. The CVSS score is 2.7, indicating a low severity issue. The EPSS score is reported as < 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local exploitation within the plugin, without remote execution capabilities.