The Community Events WordPress plugin lacks a capability check in its ajax_admin_event_approval() function, which allows an unauthenticated attacker to approve any event by supplying an arbitrary eventlist parameter. The flaw permits manipulation of event statuses and could be used to publish or promote events without proper authorization. The weakness corresponds to CWE‑862 "Missing Authorization."

All installations of the Community Events plugin released by jackdewey, version 1.5.6 and earlier, are affected. WordPress sites running any of these versions without upgrading to a newer release are exposed.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw via an unauthenticated HTTP request to the plugin’s AJAX endpoint, passing a crafted eventlist parameter. Because no authentication or authorization checks exist, the attack can be carried out without credentials, making it a straightforward remote compromise of event data.