WP Event Solution CVE-2026-28174

Exploitation requires a low-privilege authenticated WordPress account on the target site (CVSS PR:L). This could be a subscriber, customer, or any user role created via self-registration. No special plugin configuration, non-default setting, or additional system access is required beyond network access to the WordPress installation. Exploitation is limited by the need to possess or obtain a valid WordPress account - sites with registration disabled and no self-signup are not exposed via unauthenticated vectors. The vulnerability is constrained to confidentiality impact only; attackers cannot modify or delete data through this flaw.

The CVSS base score of 6.5 (Medium) reflects a network-accessible flaw with low complexity and low privilege requirements, producing high confidentiality impact - a realistic threat profile for a plugin that processes event registrations and attendee data. EPSS data is not present in the provided intelligence, and the vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept exploit has been identified. Despite the medium CVSS score, the real-world risk to organizations using this plugin for ticketed or registered events is meaningful: any authenticated WordPress user (including low-privilege subscriber accounts, which are often self-registerable) could potentially access other customers' sensitive details such as names, contact information, or booking records. Even a small event organizer or local business running a public WordPress site with self-registration enabled is meaningfully exposed if they have not patched. The low attack complexity and no-interaction-required nature mean exploitation would be straightforward for any attacker who can register an account on the target site.

An attacker registers a low-privilege account on a WordPress site running WP Event Solution (a common scenario on public event registration sites). The attacker then sends authenticated HTTP requests to the plugin's data endpoints and receives sensitive customer records - names, email addresses, booking details - belonging to other attendees. No special tools or elevated access are required beyond a valid WordPress login, making this exploitable by a malicious event registrant.