The Event post plugin is vulnerable to Insecure Direct Object References, allowing an attacker who can craft HTTP requests to read or modify event content without proper authorization. This type of IDOR flaw falls under CWE‑639 and can enable unauthorized data access or manipulation, undermining the confidentiality and integrity of event information.

The NOUS Ouvert Utile et Simple Event post plugin is affected through version 6.1.1. All installations of Event post from the earliest available release up to and including 6.1.1 are vulnerable.

The CVSS score is 6.5, reflecting a moderate severity. EPSS data is not available, and the vulnerability is not currently listed in CISA KEV. Although the exact attack vector is not specified, the likely path involves forming a crafted request to the plugin’s API or endpoint, which can be performed remotely by an authenticated or unauthenticated user depending on the configuration.