Events Manager CVE-2026-42689

Exploitation requires winning a concurrency race condition (CWE-362) in Events Manager's handling of a shared resource, meaning an attacker must send tightly-timed concurrent requests and land within a narrow synchronization window - reflected by CVSS AC:H. No authentication (PR:N) or user interaction (UI:N) is needed and the vector is network-reachable, but the probabilistic timing requirement is the dominant limiting factor, substantially reducing reliability. Affected deployments are WordPress sites running Pixelite Events Manager at or below version 7.4.7; sites on a later patched release are not exposed.

This is a low-priority issue despite being network-reachable. The CVSS 3.1 base score is 3.7 (Low), and the vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) tells a consistent, non-alarming story: exploitation is unauthenticated and remote, but requires winning a race (AC:H), and the only consequence is a limited integrity impact with no confidentiality or availability loss. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' One cross-source discrepancy is worth flagging: the Tags include 'Information Disclosure,' which implies confidentiality impact, yet the CVSS vector sets C:N and scores only I:L - the formal metrics and the tag disagree about the impact type, so the true outcome (integrity vs. disclosure) should be verified against the Patchstack advisory. Overall: a real but marginal defect, not an urgent patch priority on its own; schedule it with routine plugin maintenance.

A remote, unauthenticated attacker repeatedly and concurrently triggers the same Events Manager operation to exploit a timing window in shared-resource handling, hoping to interleave requests so that one manipulates state the other is mid-processing. Because the race must be won (CVSS AC:H), success is probabilistic and may require many attempts, and the payoff is limited to a low-level integrity effect. No public proof-of-concept was identified in the provided data.