WP Event Solution CVE-2026-97300

Exploitation requires only that a target WordPress site have the WP Event Solution (Eventin) plugin by Arraytics installed and active at version 4.1.25 or earlier and be network-reachable; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are indicated. The limiting factors are therefore scope-related rather than access-related: the site must run this specific plugin at a vulnerable version, and the realistic damage is bounded to the 'Low' impact level (partial data exposure or modification of event data), not full site compromise. The exact vulnerable feature/endpoint is not specified in the available data, so operators cannot pinpoint the triggering request path without the Patchstack advisory.

This is a medium-severity (CVSS 6.5) unauthenticated broken access control flaw in the WP Event Solution (Arraytics 'Eventin') WordPress plugin at versions <= 4.1.25, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which raises the practical exploitability. However, several signals temper the priority: there is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so there is no evidence of active or widespread exploitation - this appears to be a routine researcher-reported plugin flaw rather than an urgent in-the-wild threat. There is also a notable internal conflict: the provided CVSS vector sets C:N (no confidentiality impact) with I:L/A:L, yet the Tags label this 'Information Disclosure,' which implies a confidentiality impact - these are contradictory and should be verified against the Patchstack advisory. The impact is bounded ('Low' only), meaning this is a real but limited priority: patch in normal cycles, prioritize if the plugin is internet-facing, but it is not a high-real-risk emergency.

A remote attacker, without any authentication, sends a crafted request to a WP Event Solution plugin endpoint on a WordPress site running version 4.1.25 or earlier. Because an access-control check is missing or improperly enforced, the request succeeds and the attacker reads or alters event-related data they should not be able to access. No public exploit code was identified in the provided data, though the low attack complexity makes reliable exploitation straightforward once the vulnerable endpoint is known.