A missing authorization check in the NOUS Ouvert Utile et Simple Event post plugin allows a user to bypass configured security levels and perform actions such as creating, modifying, or deleting events. This flaw enables unauthorized individuals to alter content that the site intends to protect, potentially affecting the integrity of event listings and the overall trustworthiness of the website. The vulnerability directly targets the plugin’s internal authorization logic, exposing data that should be restricted.

The vulnerability exists in the Event post WordPress plugin from the earliest released version up to, and including, 6.1.1. Any WordPress site that installs one of these versions of the plugin is at risk. The plugin is distributed by NOUS Ouvert Utile et Simple.

The published CVSS score of 5.4 indicates a moderate severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, via crafted HTTP requests to the plugin’s endpoints without proper capability checks. An attacker with access to the web application can exploit the flaw through authenticated or unauthenticated requests, depending on the site’s configuration. The exploitation does not require local system access or privileged credentials beyond what the web application already permits.