WP Event Solution CVE-2026-66451

The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no special conditions are required - remote unauthenticated exploitation is possible against any WordPress installation with WP Event Solution 4.1.9 or earlier installed and activated. No specific non-default configuration is required; the alternate authentication path is present in the default plugin deployment. Limiting factors: exploitation impact is bounded to partial confidentiality and limited integrity (C:L/I:L) - the bypass does not grant WordPress administrative privileges or operating-system-level access. The plugin must be active (not merely installed) for the vulnerable endpoints to be registered and reachable.

The CVSS 6.5 Medium score is supported by the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating a network-exploitable, low-complexity flaw requiring no privileges or user interaction. Impact is constrained to partial confidentiality and limited integrity (C:L/I:L/A:N), meaning the bypass likely enables unauthorized access to event data or limited plugin functionality - not full site or server compromise. No EPSS score was provided in available data, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept has been identified. Despite the zero-prerequisite exploitation path, the bounded C:L/I:L impact caps the operational severity; this should nevertheless be treated as a priority for WordPress environments running the affected plugin given the trivial exploitation conditions.

An unauthenticated attacker identifies a WordPress site running WP Event Solution ≤4.1.9 and sends a crafted HTTP request directly to an alternate plugin endpoint - such as an unprotected AJAX action or REST API route - that bypasses the plugin's normal capability checks. The attacker retrieves event-related data (information disclosure) or performs limited unauthorized modifications to plugin content without possessing any WordPress credentials. No public exploit code has been identified at time of analysis, so exploitation currently requires independent discovery or reverse-engineering of the bypass path.