The vulnerability is a missing authorization in the Arraytics WP Event Solution plugin, allowing attackers to bypass configured access control levels and perform privileged actions. This flaw, identified by CWE-862, permits an unauthenticated or poorly authenticated user to gain unauthorized access to the plugin's management interface, potentially exposing or modifying event data. The impact is a loss of integrity confidentiality for event information and can also lead to further privilege escalation on the WordPress site.

Affected systems are WordPress sites that have the WP Event Solution plugin from earlier than or equal to version 4.1.26 installed. The issue exists up through 4.1.26 and is absent from 4.1.27 onward. Sites using any older version or the default unversioned state are vulnerable.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s web interface, where an attacker can manipulate URLs or form submissions to reach protected endpoints. Exploitation requires access to the WordPress site and knowledge of the plugin’s administrative routes, but no specialized credentials are necessary beyond unauthenticated access if the plugin’s restrictions are ineffective. Given the moderate CVSS and absence of known widespread exploitation, the risk is medium but should be mitigated promptly.