The vulnerability is a missing authorization check that lets an attacker exploit incorrectly configured access control security levels. This flaw can allow unauthorized access or manipulation of calendar event data, such as creating, deleting, or editing events that would normally be protected. It is classified as a CWE‑862 defect.

The issue affects Liquid Web / StellarWP The Events Calendar plugin for WordPress. All releases up to and including version 6.18.2 are vulnerable. Any site running a version in this range is at risk.

The CVSS score of 5.4 indicates medium severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly stated; it is inferred to be remote, web‑based, and relies on bypassing normal authorization checks within the plugin.