WP Event Solution CVE-2026-105073

Requires that the Arraytics WP Event Solution plugin (version n/a through 4.1.25) be installed and active on a WordPress site; the affected plugin endpoint exposing embedded sensitive data must be network-reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no non-default configuration are required - exploitation works against standard installations of the vulnerable plugin. The primary limiting factor is deployment of this specific plugin at a vulnerable version; the impact is bounded to confidentiality (C:L), meaning only partial sensitive-data exposure, not integrity or availability loss.

This is a moderate-severity information disclosure flaw (CWE-497) in the Arraytics WP Event Solution WordPress plugin, rated CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vector indicates remote, network-based exploitation at low complexity with no privileges or user interaction required, but impact is limited to low confidentiality only (no integrity or availability impact), consistent with exposure of embedded sensitive data rather than full compromise. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore a data-leakage issue rather than a critical priority: the unauthenticated network vector makes it trivially reachable, but the single low confidentiality impact caps real-world severity. EPSS and KEV data are absent from the input - this reflects missing data, not a confirmed absence of risk, so exploitation probability cannot be quantified and should not be assumed to be zero.

A remote, unauthenticated attacker sends crafted requests to a WordPress site running WP Event Solution 4.1.25 or earlier and retrieves embedded sensitive system or configuration information exposed by the plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing is needed. No public proof-of-concept is identified in the provided data.