The vulnerability is a missing authorization flaw in WP Event Manager that allows an attacker to gain unauthorized access to event data and administrative functionality. Because the plugin’s access control is incorrectly configured, a user that may not have proper permissions can exploit this flaw to view or modify events, potentially leaking or tampering with sensitive information. The weakness aligns with CWE‑862, which denotes broken access control.

All releases of the WP Event Manager plugin through version 3.2.0 are affected, including earlier builds that do not specify a specific version. The product is distributed under the vendor name WP Event Manager and is typically installed on WordPress sites as a plugin component.

The CVSS score of 5.3 indicates moderate severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not catalogued in CISA’s KEV catalog, further indicating lower current exploitation risk. However, because the flaw can be triggered remotely through the website’s public interfaces, administrators should treat the failure to enforce proper authorization as a significant risk and upgrade promptly.