WP Event Solution CVE-2026-110380

Exploitation requires only that the Arraytics WP Event Solution plugin (version n/a through 4.1.26) be installed and active on a network-reachable WordPress site; per the CVSS vector (PR:N/UI:N) no authentication, privileges, or user interaction is needed against a default install. The limiting factor is impact scope, not access: the flaw yields only low integrity impact (C:N/A:N), so an attacker can perform unauthorized modification of specific plugin-controlled data rather than achieving data disclosure, code execution, or denial of service. The description does not name a specific non-default feature or configuration prerequisite, so exploitation is expected against standard deployments of the vulnerable version.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Arraytics WP Event Solution plugin, carrying a CVSS 3.1 base score of 5.3 via vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - network-reachable, low complexity, no privileges and no user interaction, but limited to a low integrity impact only (no confidentiality or availability loss). No EPSS score, SSVC decision data, KEV listing, or POC reference was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent rather than conflicting: the low score is driven purely by the narrow impact (I:L, C:N, A:N), not by exploitation difficulty, meaning it is easy to trigger but produces bounded damage (typically unauthorized modification of a specific plugin data set rather than full compromise). Realistically this is a 'patch in routine cycle' issue, not an emergency: broadly reachable and unauthenticated, but low blast radius and unremarkable for mass exploitation. Absence of EPSS/KEV/POC here reflects missing input data, not a confirmed clean record - treat exploitation likelihood as unquantified.

A remote, unauthenticated attacker sends a crafted request to a WP Event Solution plugin endpoint that fails to verify the caller's authorization, allowing them to modify or create event-related data they should not be able to touch. Because no authentication or user interaction is required and attack complexity is low (AV:N/AC:L/PR:N/UI:N), the request can be issued directly against any exposed WordPress site running a vulnerable version. No public proof-of-concept was provided in the available data.