The CP Multi View Event Calendar plugin contains a missing authorization flaw (CWE-862) that allows attackers to access and alter event calendar data beyond their permitted scope. This could expose sensitive event details, modify schedules, or disrupt event registrations, impacting confidentiality, integrity, and potentially availability of the calendar component.

WordPress sites deploying codepeople's CP Multi View Event Calendar plugin, any version up to and including 1.4.35, are affected.

With a CVSS score of 3.8 the vulnerability is low severity, and EPSS indicates a less than 1% likelihood of exploitation. The exploit would likely be carried out through the plugin’s web interface, requiring access to an authenticated user session with insufficiently restricted permissions. Although it is not currently in CISA KEV, sites should not ignore it, as improper access controls could be leveraged for broader malicious activity.