WP Event Solution CVE-2025-68045

The vulnerable WP Event Solution plugin (Arraytics) must be installed and activated at version 4.1.12 or earlier on a WordPress site reachable by the attacker over HTTP/HTTPS, with the affected endpoint accessible (i.e., the site's REST API or admin-ajax.php is not blocked by upstream filtering). No authentication, user interaction, or non-default configuration is required per CVSS PR:N/UI:N. Limiting factors: sites that have deactivated the plugin, sites already upgraded past 4.1.12, or sites fronted by a WAF with a rule covering the specific endpoint are not exploitable; impact is bounded to confidentiality (C:H, I:N, A:N), so the flaw enables data exposure rather than site takeover or destruction based on the supplied vector.

The Patchstack-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) describes a network-reachable, low-complexity, unauthenticated information-disclosure-style impact with no integrity or availability damage - consistent with reading data via an unprotected endpoint rather than full takeover. EPSS data was not provided in the input, so a probabilistic exploitation forecast cannot be cited. The vulnerability is not in CISA KEV and no public PoC is referenced, so real-world urgency is moderate rather than emergency; however, mass-scanning of vulnerable WordPress plugins is routine, and authentication-bypass flaws in plugins are historically attractive to opportunistic attackers, so patching should still be prioritized. One caveat: the description is terse and labels the issue 'Broken Access Control' generally while the CVSS only marks Confidentiality:High - if the underlying endpoint also permits state-changing actions, integrity impact could be understated and the Patchstack advisory should be consulted to confirm.

An unauthenticated attacker discovers a WordPress site running WP Event Solution <= 4.1.12 via plugin fingerprinting, then sends an HTTP request directly to the vulnerable plugin endpoint (REST or AJAX) without supplying credentials or a valid nonce. Because the handler omits the authorization check, the server returns protected event/attendee data or executes the privileged action, leaking confidential information at scale across vulnerable sites. No public exploit code is referenced in the available data, but the low complexity and network reach make scripted, opportunistic exploitation realistic once details are widely circulated.