The reported missing authorization flaw in the Arraytics WP Event Solution plugin enables exploitation of incorrectly configured access control settings. Attackers can use this weakness to bypass intended security boundaries, allowing unauthorized access to event data and potentially administrative functions. The issue affects versions from the earliest release through 4.1.12, as identified by its integration point within the plugin. This flaw is classified as CWE‑862 and can compromise confidentiality, integrity, and availability of event information.

The affected product is the WP Event Solution plugin developed by Arraytics. Versions 4.1.12 and earlier are vulnerable. Users running the WP Event Solution plugin 4.1.12 or earlier on their WordPress sites should verify their installation level.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector is through unauthenticated HTTP requests directed at the plugin’s endpoints, allowing a remote actor to exploit the missing authorization checks. The vulnerability is exploitable regardless of whether the site allows anonymous traffic, as no authentication is required to trigger the flaw.