# AnWP Football Leagues <= 0.18.6 - Missing Authorization to Unauthenticated Club, Squad and Staff Data Exposure via REST API Routes

- **ID:** WPSEC-2026-2663
- **Plugin:** AnWP Football Leagues (`football-leagues-by-anwppro`), https://wordpress.org/plugins/football-leagues-by-anwppro/
- **Affected versions:** all versions before 0.19.0
- **Fixed in:** 0.19.0 (Update to 0.19.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/football-leagues-by-anwppro
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2663/

## Description

The AnWP Football Leagues plugin for WordPress is vulnerable to unauthorized access of data via the anwpfl/v1 get-clubs-list, get-club-season-players and get-club-season-staff REST routes in all versions up to, and including, 0.18.6, due to a permission callback that always returns true. This makes it possible for unauthenticated attackers to retrieve the ID, title and logo of every club stored by the plugin, including unpublished (draft or trashed) clubs, as well as any club's per-season squad (player names, numbers, positions and nationalities) and staff names.

## References

- https://wpsec.com/vuln/WPSEC-2026-2663/
- https://plugins.svn.wordpress.org/football-leagues-by-anwppro/tags/0.19.0/
- https://wordpress.org/plugins/football-leagues-by-anwppro/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2663/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.