This vulnerability is a missing authorization flaw that allows an attacker to perform operations on the Events Manager data without proper authentication. The flaw stems from incorrectly configured access control security levels, enabling unauthorized users to potentially view, edit, or delete event information. The weakness corresponds to CWE‑862, signifying that resource ownership and authorization checks are not enforced.

The issue affects the Events Manager WordPress plugin developed by Marcus (aka @msykes). All releases described as <= 6.6.4.1 are vulnerable; no specific revision range is given beyond the maximum version 6.6.4.1.

The CVSS score of 5.3 places the vulnerability in the moderate risk range, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the web interface of a WordPress site, where an unauthenticated or low‑privileged user could send requests to endpoints protected by this plugin to gain unauthorized access to event data. The lack of authentication checks means that any user interacting with the plugin’s endpoints could potentially manipulate event records.