WpEvently EUVD-2026-72645

No authentication is required (CVSS PR:N) and no special server-side configuration is needed beyond a publicly accessible WordPress installation running WpEvently ≤ 5.6.0 in its default state. Exploitation is structurally limited to integrity and availability impact only - the CVSS C:N metric confirms no confidentiality exposure through this vulnerability alone, so attackers cannot read sensitive data via this vector. The specific endpoint names and parameter keys involved are not detailed in the available advisory data; the precise attack surface requires review of the Patchstack technical writeup or the plugin source to enumerate affected routes.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects genuinely trivial reachability and zero authentication requirements, but the impact ceiling is bounded: there is no confidentiality exposure (C:N), and both integrity and availability impacts are rated Low, meaning an attacker cannot exfiltrate sensitive data or fully disable the service through this vector alone. No exploitation has been confirmed in CISA KEV, no public proof-of-concept code is known, and EPSS data was not provided in the available intelligence. Even a mid-sized municipal IT team in radom managing a WordPress-based events portal should treat this as a prompt but non-emergency patch - the low impact metrics and lack of active-exploitation signals place this below critical triage thresholds. SSVC analysis suggests: exploitation status - none identified; automatable - yes (no auth, low complexity, network vector); technical impact - partial (integrity and availability only). Overall, this is a moderate-priority remediation item for any public-facing deployment running the affected plugin version.

An unauthenticated attacker sends crafted HTTP requests to WpEvently's object-handling endpoints, substituting an arbitrary or victim-owned object identifier in the request parameters. Without authorization checks, the plugin processes the manipulation and allows the attacker to modify or delete event-related records - such as registrations, bookings, or event entries - owned by other users or administrators. No proof-of-concept code has been publicly identified, but the attack requires only standard HTTP tooling and knowledge of valid object ID formats.