WP Event Solution CVE-2026-28173

Exploitation requires the attacker to hold a valid WordPress account with at least customer-level privileges (PR:L per CVSS vector). Sites with open user registration are at elevated risk because an attacker can self-register to obtain the required account without any prior relationship with the target. The WP Event Solution plugin must be installed and active on a version <= 4.1.19. There is no requirement for user interaction or special server configuration beyond the plugin being active. Exploitation is limited to authenticated sessions - completely unauthenticated access is not sufficient. Sites that disable user registration entirely, restrict the customer role, or require manual account approval significantly reduce their exposure.

The CVSS 7.1 (High) vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H characterizes this as a straightforward, low-complexity network attack requiring only a valid customer-level account. The high availability impact (A:H) reflects that arbitrary deletion of event or site content can significantly degrade site functionality. No EPSS score is provided in available data, and the CVE is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. WordPress plugin vulnerabilities affecting the customer or subscriber role are historically targeted because open-registration sites expose this attack surface to anonymous internet users who simply self-register. The missing-authorization class (CWE-862) is consistently among the most commonly exploited WordPress vulnerability types, making this a realistic near-term exploitation candidate despite the current absence of known public exploits.

An attacker visits a WordPress site running WP Event Solution <= 4.1.19 with open user registration enabled, self-registers a customer-level account, and then submits crafted HTTP requests to the plugin's content deletion endpoint - bypassing the absent or ineffective authorization check - to delete event listings, posts, or other content managed by the plugin at scale. No public exploit has been identified at time of analysis, but the low complexity and minimal privilege bar make manual exploitation straightforward once the vulnerable endpoint is enumerated.