The CVE exposes a missing authorization flaw in the Arraytics WP Event Solution plugin. Because access controls are misconfigured, an attacker can reach privileged plugin endpoints and create, edit, or delete events without the necessary permissions. This undermines the integrity of event data and can allow an attacker to compromise the website’s event management function.

The vulnerability affects all builds of the Arraytics WP Event Solution plugin from the earliest available through version 4.1.25. Any WordPress site that has the plugin installed and has not upgraded beyond 4.1.25 is at risk.

The CVSS score of 5.3 represents moderate severity. EPSS information is not available, so the likelihood of exploitation is uncertain. The plugin’s administrative interface is the likely attack surface; an attacker may target the plugin via crafted HTTP requests or by exploiting a misconfigured user role that grants elevated privileges. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploits at this time. Organizations should consider the plugin’s exposure when determining risk.