Technical impact
The vulnerability is a broken access control flaw that allows an attacker to bypass the plugin’s normal authorization checks and perform restricted operations. This missing authorization means that users who should not have certain capabilities can elevate their privileges within the WordPress site. The impact is that an attacker could potentially create or modify events, delete content, or otherwise manipulate the site’s data, thereby compromising the confidentiality, integrity, or availability of the WordPress installation.
Affected Systems
WordPress sites that use the Magepeople inc. WpEvently plugin, named mage‑eventpress, are affected. All releases through and including version 5.7.8 are vulnerable, while version 5.7.9 and later provide the fix.
Risk and Exploitability
The CVSS score of 6.5 classifies the vulnerability as moderate. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, indicating no known active exploitation at the time of analysis. The likely attack vector involves interacting with the plugin’s administrative API or UI; an attacker would need at least the ability to authenticate to the WordPress site, but the missing checks allow escalation of privileges without additional prerequisites. The exploitation would enable unauthorized users to perform privileged actions normally reserved for higher‑level administrators.
