A missing authorization check in the WpEvently WordPress plugin allows an attacker who can reach the plugin’s endpoints to perform actions reserved for privileged users. This improper access control flaw is classified as CWE‑862 and can lead to unauthorized data modification or retrieval. The vulnerability does not grant remote code execution but compromises data integrity by allowing the attacker to intervene in the plugin’s operational flow.

WordPress WpEvently plugin (Mage‑EventPress) is affected for all releases up to and including version 4.4.6. Any WordPress installation deploying the plugin before this version is susceptible.

The published CVSS score of 4.3 suggests a moderate impact when the flaw is exploited. An EPSS score of less than 1% indicates a very low probability of being actively targeted in the wild, and the issue is currently not listed in the CISA KEV catalog. Given that the plugin’s functionality is exposed via web interfaces, the most likely attack vector is a remote web‑based request to the plugin’s endpoints. Exploitation requires only the ability to access these endpoints, with no prerequisite authentication or elevated privileges. The overall threat level is moderate, but administrators should remain vigilant for malicious activity involving the plugin’s access controls.