Event Post EUVD-2026-97287

Exploitation requires an authenticated account on the target WordPress site (CVSS PR:L), so the attacker must be able to register or already possess at least a low-privilege login - this is the primary limiting factor. The core precondition is the plugin's incorrectly configured access-control check, which allows a user-controlled key/identifier to reference objects belonging to other users (classic IDOR). No user interaction is needed (UI:N) and no special non-default feature toggle is named in the description; the flaw is present in Event post versions from n/a through 6.1.1. Realistic risk is highest on sites permitting open or untrusted user registration and negligible on sites with no low-privilege external accounts.

This is a moderate-severity Insecure Direct Object Reference (IDOR / CWE-639) issue in the WordPress 'Event post' plugin, scored CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The signals are internally consistent: network vector with low attack complexity, but it requires an authenticated low-privilege account (PR:L), and impact is confined to integrity (I:H) with no confidentiality or availability effect - meaning an attacker can modify/manipulate objects (e.g. event posts) belonging to other users but cannot read protected data or crash the service through this flaw. No EPSS score, KEV listing, or POC was provided in the input. There is no public exploit identified at time of analysis and it is not in CISA KEV, so despite the 'network' vector the real-world risk is bounded by the authentication requirement and the integrity-only impact. This is a legitimate but second-tier fix - not an emergency - and the priority is highest for sites that allow untrusted user registration. Note: no EPSS data was supplied, so exploitation probability cannot be quantified from the input.

An attacker registers or obtains a low-privilege account on a WordPress site running Event post ≤ 6.1.1, then sends a request that references another user's event object by manipulating a user-controlled identifier (key). Because access control is incorrectly enforced, the server honors the request and lets the attacker modify event content that does not belong to them. No public exploit code was identified at time of analysis, and no user interaction is required.