The issue in the WordPress WpEvently mage‑eventpress plugin is that access controls are missing or incorrectly configured, allowing users to perform actions they should not be able to. This flaw, classified as CWE‑862, lets an attacker create, modify, or delete events and potentially read sensitive plugin configuration data. The resulting breach could undermine site integrity through unauthorized content manipulation.

The affected plugin is WpEvently mage‑eventpress from magepeopleteam. All releases up to and including version 5.0.4 are impacted; no newer versions have been identified to address the flaw.

The CVSS score of 5.3 indicates moderate severity. Although the EPSS score is less than 1%, it still shows a small probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote through the web interface of the hosting site, as the flaw stems from missing authorization checks on plugin endpoints. It is inferred from the description that no authentication requirement is explicitly stated, which means both authenticated or unauthenticated users who can reach the endpoints may abuse the access controls if they have network access to the site.