The vulnerability is an unauthenticated broken access control flaw in the WordPress WP Event Solution plugin versions up to 4.1.22. Based on the description, this flaw enables an attacker to invoke plugin functions without authentication. The likely attack vector is making HTTP requests to the plugin’s exposed endpoints, which could allow the attacker to create, modify, or delete events and access sensitive data related to the plugin, thereby compromising the integrity and confidentiality of the event data.

The affected product is the WordPress WP Event Solution plugin from Arraytics, version 4.1.22 and earlier. Site owners running any of these versions on a WordPress installation are at risk. The plugin version 4.1.23 or later has the issue fixed.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, suggesting it is not currently exploited in the wild. Because the broken access control flaw allows an attacker who can reach the plugin endpoints to exercise privileged actions without authentication, the attack can be performed over standard HTTP requests. Based on the CVSS score, the potential impact is moderate, and administrators should patch promptly given the lack of reported exploitation.