The flaw is an unauthenticated Other Vulnerability Type in the WordPress WpEvently plugin through version 5.3.3. The issue is defined as a vulnerability that can be triggered without any prior authentication and is catalogued as CWE‑1284. The reported CVSS score of 7.5 signals a high severity, indicating that a successful exploitation could lead to unintended functionality or data exposure, though the exact impact is not explicitly detailed in the description.

All instances of the WordPress WpEvently plugin purchased from Magepeople inc. that are running any version up to 5.3.3 are affected. No other vendors or products are listed in the CNA data for this CVE.

The CVSS score places this flaw in the high‑severity range, but the EPSS score of less than 1% suggests that, as of the data available, tools and malware are unlikely to be actively exploiting it yet. The vulnerability is not referenced in the CISA KEV catalog. Based on the description, the likely attack vector is through unauthenticated web requests to the plugin’s exposed endpoints, allowing an external actor to exploit the flaw without needing to authenticate to the WordPress site.