The vulnerability in the EventON plugin stems from missing authorization logic, allowing requests that should be restricted by access control lists to be executed. Attackers can invoke privileged functions—such as creating, editing, or deleting events—without the proper permissions, thereby gaining unauthorized control over event data and exposure. The weakness is a classic access‑control flaw, identified as CWE‑862, which undermines the confidentiality and integrity of the event management system.

Products affected are the WordPress EventON plugin by ashanjay, with all releases through version 4.9.8 vulnerable. Any installation running these versions is susceptible if the plugin is active.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, further reducing its current risk prominence. The likely attack vector is sending crafted requests to unsecured plugin endpoints that lack proper permission checks. Attackers would need either to be authenticated users with limited privileges or possibly unauthenticated users able to target the exposed functionality, depending on the configuration of the WordPress instance.