{
 "id": "WPSEC-2026-2663",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2663/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2663/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2663/index.md",
 "title": "AnWP Football Leagues <= 0.18.6 - Missing Authorization to Unauthenticated Club, Squad and Staff Data Exposure via REST API Routes",
 "description": "The AnWP Football Leagues plugin for WordPress is vulnerable to unauthorized access of data via the anwpfl/v1 get-clubs-list, get-club-season-players and get-club-season-staff REST routes in all versions up to, and including, 0.18.6, due to a permission callback that always returns true. This makes it possible for unauthenticated attackers to retrieve the ID, title and logo of every club stored by the plugin, including unpublished (draft or trashed) clubs, as well as any club's per-season squad (player names, numbers, positions and nationalities) and staff names.",
 "plugin": {
  "slug": "football-leagues-by-anwppro",
  "name": "AnWP Football Leagues",
  "full_name": "AnWP Football Leagues",
  "wordpress_org": "https://wordpress.org/plugins/football-leagues-by-anwppro/",
  "advisories_url": "https://wpsec.com/vuln/plugin/football-leagues-by-anwppro/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/football-leagues-by-anwppro"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "0.19.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 0.19.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "0.19.0",
 "remediation": "Update to 0.19.0 or later.",
 "fix_released": "2026-11-05T13:37:46+00:00",
 "published": "2026-11-06T13:52:33+00:00",
 "updated": "2026-11-06T12:03:15.644973+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2663/",
  "https://plugins.svn.wordpress.org/football-leagues-by-anwppro/tags/0.19.0/",
  "https://wordpress.org/plugins/football-leagues-by-anwppro/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/football-leagues-by-anwppro",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-06"
 }
}