CVE-2024-1177 MEDIUM

CVE-2024-1177: WP Club Manager – WordPress Sports Club Plugin <= 2.2.10 - Missing Authorization to Unauthenticated Event Permalink Update

Vendor Wpclubmanager
Product WP Club Manager – WordPress Sports Club Plugin
Weakness CWE-862 · Missing authorization
Published February 5, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to update the permalink structure for the clubs

Key dates

02Disclosure timeline

February 5, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-48916 Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070 CVE-2026-0820 RepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders CVE-2025-39451 WordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control Vulnerability CVE-2023-39997 WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control Vulnerability CVE-2025-31881 WordPress Pearl plugin <= 1.3.9 - Broken Access Control vulnerability