What is the CVSS score of CVE-2026-65486?

CVE-2026-65486 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Event Post CVE-2026-65486

EUVD-2026-48097 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-h2c8-cc4j-v4f7

WordPress Authentication Bypass Event Post Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint with no complexity barrier; impact bounded to partial confidentiality read with no integrity or availability consequence, consistent with a read-only authorization bypass.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:20 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

AnalysisAI

Unauthenticated broken access control in the Event Post WordPress plugin (versions <= 6.0.1) allows remote attackers without any credentials to bypass authorization checks and access restricted functionality or data. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with no authentication, no user interaction, and low attack complexity, making it trivially scriptable. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated network vector means vulnerable sites can be mass-scanned.

Technical ContextAI

Event Post is a WordPress plugin developed by Bastien Ho (CPE: cpe:2.3:a:bastien_ho:event_post) that enables WordPress sites to manage and display event-type posts. The vulnerability class, CWE-862 (Missing Authorization), indicates the plugin fails to verify whether a requesting user holds the necessary permissions before executing one or more privileged operations - a common pattern in WordPress plugins where REST API endpoints or admin-ajax.php handlers omit current_user_can() checks or nonce validation. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the affected code path is reachable over HTTP without authentication and without requiring any special configuration to trigger.

RemediationAI

No exact patched version was confirmed in the available data - the fix version must be verified via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/event-post/vulnerability/wordpress-event-post-plugin-6-0-1-broken-access-control-vulnerability) or the official WordPress plugin repository; patch availability is indicated per vendor advisory. If a patched release is not yet available, the most effective compensating control is to deactivate the Event Post plugin entirely until a fix is confirmed, eliminating the attack surface without side effects to other site functionality. If deactivation is not feasible, restricting unauthenticated access to WordPress REST API endpoints and admin-ajax.php via a WAF rule or web server configuration (e.g., returning 403 for unauthenticated requests to plugin-specific action parameters) can reduce exploitability, though this may break expected plugin behavior for legitimate users. Network-level IP allowlisting for sensitive admin routes is an additional layer with the trade-off of blocking legitimate remote access.