EUVD-2026-97292
GHSA-r6r4-c2pr-7v78
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitSend request to unprotected plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactRead or modify restricted event data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an existing authenticated account on the target WordPress site at low privilege (CVSS PR:L) - unauthenticated visitors cannot trigger it - and the 'Event post' plugin must be installed and active at a version from initial release through 6.1.1. The flaw is a missing authorization/capability check on a plugin action, so the limiting factor is that the attacker must first obtain any valid low-privilege login (e.g., self-registration enabled, or a subscriber/contributor account); no user interaction and no special non-default configuration are indicated. Impact is bounded to the event data and operations the vulnerable endpoint exposes (partial confidentiality and integrity), with no availability effect. |
| Impact | This is a moderate-severity Missing Authorization flaw (CWE-862) in the WordPress 'Event post' plugin, scored CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). The vector indicates network-reachable, low-complexity exploitation but requires PR:L - i.e., an already-authenticated low-privilege account (e.g., subscriber/contributor), which meaningfully limits blast radius. Impact is partial confidentiality and integrity (C:L/I:L) with no availability impact, consistent with a user performing actions above their intended authorization level rather than full compromise. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only source is a single Patchstack advisory (research-reported, not vendor-confirmed in the provided data), and no patched/fixed version is stated beyond 'affects through 6.1.1'. Net: this is a real but not urgent issue - the authentication requirement and medium CVSS argue against emergency prioritization, and the absence of KEV/EPSS/POC signals supports routine patch-cycle handling rather than an out-of-band response. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on a WordPress site running the Event post plugin (≤6.1.1) sends a request to a plugin endpoint that fails to verify the caller's authorization. Because of the missing capability/authorization check, they read or modify event data they should not be able to access. No public exploit code was identified, and the attack requires a valid low-privilege login. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Low-privilege authenticated users can bypass access-control checks in the WordPress 'Event post' plugin (versions from initial release through 6.1.1), allowing them to perform event-management actions and read or modify event data they are not authorized to touch. The flaw is a CWE-862 missing authorization issue scored CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires an existing account on the target site at subscriber/contributor-level privilege or higher - unauthenticated visitors cannot trigger it directly, though self-registration or any low-privilege account lowers the bar. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; impact is limited to partial confidentiality and integrity of event data with no availability effect.
RemediationAI
No vendor-released patch version is identified in the available intelligence for CVE-2026-107432, so treat the fix as pending and check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/event-post/vulnerability/wordpress-event-post-plugin-6-1-1-broken-access-control-vulnerability?_s_id=cve plus the WordPress.org plugin page for an updated release before assuming any version is safe. Until a patched build is published, the highest-value compensating control is to deactivate and remove the 'Event post' plugin if event functionality is not essential - this eliminates the vulnerable endpoint entirely at the cost of losing the plugin's event features. If the plugin must stay active, disable open user registration and audit existing accounts so that untrusted users cannot obtain the low-privilege login the attack requires (PR:L), since removing the attacker's foothold account neutralizes the exploit path; the trade-off is reduced site self-service and additional account-management overhead. Additionally, restrict the site's user roles so only trusted editors or administrators hold contributor-level or higher capabilities, and deploy a WAF rule or plugin-level capability filter that blocks non-privileged requests to the plugin's event-management actions - noting that WAF signatures may be incomplete against custom action names and could produce false positives for legitimate event workflows. Monitor logs for unexpected event-record modifications by low-privileged accounts as a detection backstop.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a WordPress plugin access-control defect classified as CWE-862 (Missing Authorization) in the 'Event post' plugin maintained by NOUS Ouvert Utile et Simple. WordPress plugins typically expose administrative actions through admin-ajax.php handlers, REST API routes, or direct POST handlers; when such an endpoint omits a current_user_can() capability check or nonce/authorization verification, any logged-in user - including a subscriber or contributor - can invoke functionality reserved for editors or administrators. Here the CPE cpe:2.3:a:nous_ouvert_utile_et_simple:event_post:*:*:*:*:*:*:*:* confirms the affected component is the plugin package itself across all shipped versions, and the CVSS vector's PR:L component matches the root cause: the missing check is not a pre-authentication bypass but an over-permissive authorization boundary that low-privileged accounts can cross. The reported vector shows only Low confidentiality and Low integrity impact with no availability impact, consistent with an endpoint that exposes or mutates event records rather than one permitting arbitrary file writes or code execution.
Know when Event Post gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable plugin endpoint (AV:N/AC:L), but a valid low-privilege WordPress account is required (PR:L); missing authorization yields partial read/write (C:L/I:L) with no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Event Post
View allAuthorization bypass through a user-controlled key in the WordPress 'Event Post' plugin (NOUS Ouvert Utile et Simple), a
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Rated med
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event p
The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's events_cal shortcode i
Unauthenticated broken access control in the Event Post WordPress plugin (versions <= 6.0.1) allows remote attackers wit
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check
Exploit-DB