WordPress WP Event Solution plugin versions up to 4.1.25 suffer from a missing authorization flaw that allows users lacking sufficient privileges to perform protected actions. The vulnerability is caused by incorrectly configured access control security levels, and it can let an attacker elevate privileges, modify event data, or access sensitive plugin settings, leading to potential data disclosure or integrity issues. The weakness is classified as CWE‑862.

Affected vendor is Arraytics, product WP Event Solution plugin for WordPress. All installations using any version released up to and including 4.1.25 are vulnerable. Users of WP‑Event‑Solution on WordPress sites should verify their plugin version and consider upgrading.

The CVSS score is 5.3, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is through the WordPress web interface, where an attacker can exploit the plugin by crafting HTTP requests that bypass the missing authorization checks. If an attacker has any authenticated access to the site with a role lower than required, the vulnerability can be leveraged; an unauthenticated attacker may also succeed if the site does not enforce user checks on the plugin endpoints. Exploitation requires only standard web request capabilities, so the risk of compromise is non‑negligible for sites that have the vulnerable plugin installed.