The vulnerability stems from a missing authorization check in the Metagauss Event Kikfyre plugin, allowing attackers to bypass configured access control levels. This can be exploited to view, modify, or delete event data and ticket information that should be restricted to privileged users. The weakness is classified as CWE‑862, indicating improper access control.

Users running the WordPress Event Kikfyre plugin version 2.1.8 or earlier are affected. The issue occurs in any installation where the plugin is present, regardless of site configuration, and applies to all user roles that have not been manually restricted by site administrators.

The CVSS base score of 5.4 scores the vulnerability as moderate. The EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely target a publicly accessible WordPress site, attempting to craft a request that leverages the missing authorization check to elevate privileges or access protected plugin resources. No specific exploitation method was detailed in the advisories, but the absence of an authorization gate suggests that exploitation can occur by directly accessing URLs or endpoints that the plugin exposes.