Vulnerabilities / AnWP Football Leagues / WPSEC-2026-2663
AnWP Football Leagues <= 0.18.6 - Missing Authorization to Unauthenticated Club, Squad and Staff Data Exposure via REST API Routes
Medium 5.3
CWE-862Fixed in 0.19.0
- ID
- WPSEC-2026-2663
- Plugin
- AnWP Football Leagues (football-leagues-by-anwppro)
- Affected
- all versions before 0.19.0
- Remediation
- Update to 0.19.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- AnWP Football Leagues on WPSec AttackSurface
- Fix released
- Published
Description
The AnWP Football Leagues plugin for WordPress is vulnerable to unauthorized access of data via the anwpfl/v1 get-clubs-list, get-club-season-players and get-club-season-staff REST routes in all versions up to, and including, 0.18.6, due to a permission callback that always returns true. This makes it possible for unauthenticated attackers to retrieve the ID, title and logo of every club stored by the plugin, including unpublished (draft or trashed) clubs, as well as any club's per-season squad (player names, numbers, positions and nationalities) and staff names.
References
- https://wpsec.com/vuln/WPSEC-2026-2663/
- https://plugins.svn.wordpress.org/football-leagues-by-anwppro/tags/0.19.0/
- https://wordpress.org/plugins/football-leagues-by-anwppro/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS