What is the CVSS score of CVE-2026-66451?

CVE-2026-66451 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

WP Event Solution CVE-2026-66451

EUVD-2026-53884 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-06 Patchstack

GHSA-g5q3-jjf3-h8h5

Information Disclosure Wp Event Solution WordPress Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible with no prerequisites confirmed by CWE-288 and description; C:L/I:L reflects partial data exposure and limited write, not full compromise; no availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:14 vuln.today

DescriptionCVE.org

Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.

AnalysisAI

Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

WP Event Solution is a WordPress plugin developed by Arraytics (CPE: cpe:2.3:a:arraytics:wp_event_solution:*:*:*:*:*:*:*:*) used for managing and displaying events on WordPress sites. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), a class in which an application exposes a secondary code path - such as an unauthenticated REST API endpoint, AJAX handler (wp-admin/admin-ajax.php), or direct file inclusion - that does not enforce the same authentication checks as the primary interface. This pattern is endemic to WordPress plugin development, where contributors may register AJAX or REST routes without the required capability checks or nonce validation, inadvertently creating authentication bypass vectors accessible to any remote party.

RemediationAI

Update WP Event Solution to a version beyond 4.1.9 - the exact patched release version is not independently confirmed from available data, so administrators should verify the current safe version directly via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-9-broken-authentication-vulnerability. If immediate patching is not feasible, temporarily deactivate the plugin to remove the attack surface entirely, accepting the trade-off of losing all event management functionality. As a partial compensating control, a web application firewall (WAF) with WordPress-specific ruleset (e.g., Patchstack vPatch, Wordfence, or Cloudflare's WordPress managed ruleset) may block exploitation attempts targeting unauthenticated plugin endpoints, though this does not remediate the underlying flaw.