Arraytics
Monthly
Stored cross-site scripting in the WP Event Solution WordPress plugin, affecting versions through 4.1.26, lets an actor who can store input that the plugin later renders execute script in the browser of a user who views the affected page. The CVSS vector requires victim interaction (UI:R) and indicates a scope change (S:C), and the supplied vector lists PR:N although the specific field and capability required are not described in the available sources; if authenticated submission is in fact required, exploitation is more limited. This is a moderate, not emergency, priority (vuln.today decision: this_week), and no public exploit was identified at time of analysis.
Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.
Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
WP Event Solution WordPress plugin versions up to and including 4.1.19 allows authenticated users with customer-level privileges to delete arbitrary content due to missing authorization controls (CWE-862). The vulnerability is network-exploitable with low privilege requirements and no user interaction, yielding high availability impact through unrestricted content deletion. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and including 1.0.58, allowing unauthenticated remote attackers to inject script that executes in a victim's browser after the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), a successful injection can affect resources beyond the vulnerable component, such as the browser session of a logged-in administrator. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was provided.
Unauthenticated PHP Object Injection in the Booktics WordPress plugin (by Arraytics) affects all versions up to and including 1.0.21, letting remote attackers with no authentication inject arbitrary PHP objects into the application. If a suitable POP (property-oriented programming) gadget chain exists in the plugin, WordPress core, or another active plugin, this can escalate to remote code execution, data theft, or full site takeover. Reported by Patchstack and rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in the Arraytics WP Event Solution (Eventin) WordPress plugin through version 4.1.8 allows remote attackers to bypass access control checks and read data they should not be permitted to access. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36985; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in Timetics WordPress plugin through version 1.0.53 allows unauthenticated remote attackers to bypass access controls and access sensitive administrative functions or data. With CVSS 8.2 (High), the vulnerability enables high confidentiality impact and low integrity impact against network-accessible instances. Patchstack reported this broken access control flaw, indicating potential exposure of booking systems, customer data, or administrative operations to unauthorized access without authentication.
A missing authorization vulnerability exists in Arraytics WPCafe WordPress plugin versions up to 3.0.7, where incorrectly configured access control allows attackers to bypass authentication and authorization checks. This broken access control flaw (CWE-862) enables unauthorized users to perform actions they should not have permission to execute, potentially leading to unauthorized data access, modification, or plugin functionality abuse. The vulnerability affects all installations of WPCafe through version 3.0.7 and is tracked under ENISA EUVD ID EUVD-2026-15773 with confirmation from Patchstack vulnerability research.
Missing authorization in Arraytics Booktics through 1.0.30 lets unauthenticated remote attackers reach a plugin endpoint that should be access-controlled, exposing limited data (CVSS 5.3). The issue is CWE-862 and affects WordPress sites with the plugin active; no public exploit identified at time of analysis.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (versions through 4.1.26) allows unauthenticated remote attackers to bypass access controls and modify plugin-controlled data, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (low integrity impact only, no confidentiality or availability loss). This moderate-severity CWE-862 flaw requires only that the vulnerable plugin be installed and network-reachable on a WordPress site; no authentication or user interaction is needed. At time of analysis, no public exploit identified and the issue is not listed in CISA KEV.
Missing authorization in Arraytics WP Event Solution versions through 4.1.25 allows remote, unauthenticated attackers to make limited unauthorized changes under the plugin's default installation, as reflected by the integrity-only CVSS 5.3 score. The target site must have the vulnerable plugin installed and activated, and no user interaction is required; there is no KEV confirmation or public exploit code identified in the provided data. This is a moderate-to-low priority access-control flaw (CWE-862) rather than a confidentiality or availability compromise.
Missing authorization in the Arraytics Booktics WordPress plugin (versions through 1.0.28) lets an authenticated low-privilege user - such as a subscriber or customer - invoke plugin functionality that should be reserved for higher-privileged roles, resulting in limited unauthorized data disclosure and modification. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) confirms the attack is network-reachable and requires no user interaction, but an account on the target site is a hard prerequisite, and there is no availability impact. No public exploit code has been identified at time of analysis, and this is assessed as a moderate, not high-priority, issue.
Missing authorization checks in the Arraytics Booktics WordPress plugin through version 1.0.28 let unauthenticated remote attackers invoke functionality that should require elevated privileges, resulting in a limited integrity-only impact (CVSS 5.3, CWE-862). Because the CVSS vector is PR:N/UI:N, exploitation needs only network reachability of the vulnerable endpoint on a site running the plugin - no account, no victim interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity makes the flaw attractive to automated WordPress scanning and mass-exploitation tooling; risk is tempered by the plugin's small deployment footprint and the fact that confidentiality and availability are unaffected.
Missing authorization in the Booktics WordPress plugin (versions up to and including 1.0.27) allows authenticated low-privilege users to access restricted data, resulting in limited confidentiality exposure. The flaw requires a valid account on the target site but no administrative rights and no user interaction, affecting only sites with the plugin installed and activated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the CVSS score is 4.3 (moderate).
Unauthenticated broken access control in the WP Event Solution (Eventin) WordPress plugin, versions 4.1.25 and earlier, allows any remote, network-reachable attacker to reach functionality that should require authorization, with the realistic outcome bounded to low-severity exposure or manipulation of event-related data rather than full site compromise. The flaw carries a vendor-style CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N), and our independent reassessment scopes the impact to low confidentiality only, with no authentication, user interaction, or non-default configuration required. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code has been identified at time of analysis; the only public reporting is the Patchstack advisory, and the specific vulnerable endpoint is not disclosed, which limits operators' ability to target blocking rules precisely.
Missing authorization in the Arraytics Timetics WordPress plugin (versions through 1.0.63) lets remote attackers trigger plugin actions that lack proper access-control checks, allowing limited integrity and availability impact on affected sites (CVSS 6.5, CWE-862). The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L confirms exploitation is unauthenticated and requires no victim interaction, though the impact is bounded - no confidentiality loss - and any WordPress installation running the vulnerable plugin with the affected endpoint reachable is exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by Patchstack, and the affected range ends at 1.0.63.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows remote attackers to invoke functionality that should be restricted to privileged users, with the CVSS vector AV:N/AC:L/PR:N/UI:N indicating no authentication, no user interaction, and no non-default configuration are needed against a site that has the plugin installed and active. Impact is limited to integrity (C:N/I:L/A:N), so affected installations face unauthorized modification or creation of plugin-managed content rather than data disclosure or denial of service. The issue is rated moderate (CVSS 5.3) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive information disclosure in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows any remote attacker to retrieve embedded sensitive data from the plugin's exposed endpoint. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation requires no credentials, no user interaction, and no non-default configuration - only that the plugin is installed and active and the affected endpoint is network-reachable. Impact is limited to partial confidentiality loss (C:L, CVSS 5.3) with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated attackers can read, create, update, clone, and delete the email notification flows of the WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin in all versions up to and including 3.0.19, because the plugin fails to verify that a caller is authorized before processing flow-management requests (CWE-862). The exposed endpoints require no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), no user interaction, and no special configuration, since Email_Automation_Service_Provider::is_enable() unconditionally returns true and five pre-configured email flows ship with the plugin on activation; the practical result is attacker-controlled reservation confirmation, cancellation, and admin alert emails sent from the site's legitimate address, plus outright destruction of those flows. No public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); the supplied assessment rates impact as low across confidentiality, integrity, and availability and constrains the damage to the plugin's email notification subsystem rather than the wider WordPress site.
Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the `etn_shedule_objective` field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in the Booktics WordPress plugin (by Arraytics) through version 1.0.24 permits unauthenticated remote attackers to perform restricted write operations without any authentication. The CVSS vector (PR:N, I:L) confirms the flaw allows unauthorized integrity-impacting actions - such as modifying booking data or plugin state - accessible directly over the network. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized customer data modification in the Booktics WordPress plugin allows unauthenticated remote attackers to overwrite any existing customer's stored name, phone number, and linked WordPress user ID by supplying only the target's email address in a crafted REST API request. All plugin versions through 1.0.23 by Arraytics are affected, with the root cause split between a permission callback that unconditionally returns true and a guest-update function that applies caller-supplied contact data to any record whose email matches without ownership verification. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes systematic data poisoning of booking reminders, SMS notifications, and CRM integrations feasible for any attacker who can enumerate customer emails.
Authorization bypass in Eventin - Event Calendar plugin for WordPress (all versions ≤4.1.17) allows authenticated subscriber-level users to fully manage notification flow automation workflows restricted to administrators. Exploitation requires only a low-privilege WordPress account, enabling unauthorized read, create, update, clone, and delete operations on event automation configurations. No public exploit or KEV listing identified; vendor-released patch 4.1.18 resolves the flaw.
Ticket inventory exhaustion in WP Event Solution (Eventin) ≤4.1.22 allows any unauthenticated visitor to forge completed event orders and permanently lock out legitimate ticket buyers. The REST endpoint /wp-json/eventin/v2/orders relies solely on a wp_rest nonce for authorization, but that nonce is broadcast to every site visitor via the etn-public script's localized_data_obj - making the check functionally equivalent to no check at all. By submitting crafted POST requests with status='completed', attackers create persistent fake sold-order records that count against ticket inventory indefinitely, since the auto-cleanup scheduler only targets pending orders. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authorization bypass in the Eventin WordPress plugin (versions 4.0.26-4.1.15) enables unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash to the payment_complete() REST endpoint. The wp_rest nonce required to reach this endpoint is embedded in the HTML of every public event page, eliminating any credential or session requirement. This is a confirmed regression - the same function and endpoint were previously patched by Arraytics, but the fix was lost in subsequent releases; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the Eventin WordPress event management plugin (all versions through 4.1.15) lets any contributor-level user permanently embed malicious JavaScript in event FAQ sections via the unescaped `etn_faq_content` parameter. The CVSS scope change (S:C) confirms the impact crosses the attacker's security context - injected scripts execute in any visitor's browser who loads the affected event page, enabling session hijacking or credential harvesting of higher-privileged users including site administrators. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity and commonly granted contributor role make this a credible insider-threat risk on multi-user WordPress installations.
Authorization bypass in the WPCafe WordPress plugin (all versions through 3.0.14) allows any authenticated subscriber-level user to fully manage email notification flow workflows that are intended to be administrator-only. The FlowAPI REST endpoints bundled within the plugin's email notification SDK rely solely on a wp_rest nonce for access control - a token freely obtainable from the frontend page source by any logged-in user - completely bypassing role-based authorization. No public exploit or active exploitation has been identified at time of analysis, though the low exploitation complexity makes this a realistic risk on sites with open user registration.
Broken access control in the Arraytics WP Event Solution WordPress plugin through version 4.1.12 allows remote unauthenticated attackers to access protected functionality or data without authorization. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, exposing sensitive event-management capabilities or data to anyone who can reach the WordPress site. No public exploit identified at time of analysis, and the issue is not currently listed in the CISA KEV catalog.
Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user capabilities in the get_item_permissions_check() function, allowing authenticated Subscriber-level users to enumerate and read arbitrary order data including customer names, emails, and phone numbers through order ID iteration. Affected versions include all releases up to and including 4.1.8. This is a low-complexity, network-accessible vulnerability (CVSS 4.3) that requires only basic authentication, making it exploitable by any user with a WordPress account on an affected site.
Missing authorization in Arraytics Booktics WordPress plugin through version 1.0.16 allows unauthenticated remote attackers to modify application data via incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.02%, percentile 4) despite the network-accessible attack vector, suggesting limited real-world exploitation likelihood. No public exploit code or active CISA KEV status has been identified.
Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.0.23. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in the WP Event Solution WordPress plugin, affecting versions through 4.1.26, lets an actor who can store input that the plugin later renders execute script in the browser of a user who views the affected page. The CVSS vector requires victim interaction (UI:R) and indicates a scope change (S:C), and the supplied vector lists PR:N although the specific field and capability required are not described in the available sources; if authenticated submission is in fact required, exploitation is more limited. This is a moderate, not emergency, priority (vuln.today decision: this_week), and no public exploit was identified at time of analysis.
Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.
Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
WP Event Solution WordPress plugin versions up to and including 4.1.19 allows authenticated users with customer-level privileges to delete arbitrary content due to missing authorization controls (CWE-862). The vulnerability is network-exploitable with low privilege requirements and no user interaction, yielding high availability impact through unrestricted content deletion. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and including 1.0.58, allowing unauthenticated remote attackers to inject script that executes in a victim's browser after the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), a successful injection can affect resources beyond the vulnerable component, such as the browser session of a logged-in administrator. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was provided.
Unauthenticated PHP Object Injection in the Booktics WordPress plugin (by Arraytics) affects all versions up to and including 1.0.21, letting remote attackers with no authentication inject arbitrary PHP objects into the application. If a suitable POP (property-oriented programming) gadget chain exists in the plugin, WordPress core, or another active plugin, this can escalate to remote code execution, data theft, or full site takeover. Reported by Patchstack and rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in the Arraytics WP Event Solution (Eventin) WordPress plugin through version 4.1.8 allows remote attackers to bypass access control checks and read data they should not be permitted to access. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36985; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in Timetics WordPress plugin through version 1.0.53 allows unauthenticated remote attackers to bypass access controls and access sensitive administrative functions or data. With CVSS 8.2 (High), the vulnerability enables high confidentiality impact and low integrity impact against network-accessible instances. Patchstack reported this broken access control flaw, indicating potential exposure of booking systems, customer data, or administrative operations to unauthorized access without authentication.
A missing authorization vulnerability exists in Arraytics WPCafe WordPress plugin versions up to 3.0.7, where incorrectly configured access control allows attackers to bypass authentication and authorization checks. This broken access control flaw (CWE-862) enables unauthorized users to perform actions they should not have permission to execute, potentially leading to unauthorized data access, modification, or plugin functionality abuse. The vulnerability affects all installations of WPCafe through version 3.0.7 and is tracked under ENISA EUVD ID EUVD-2026-15773 with confirmation from Patchstack vulnerability research.
Missing authorization in Arraytics Booktics through 1.0.30 lets unauthenticated remote attackers reach a plugin endpoint that should be access-controlled, exposing limited data (CVSS 5.3). The issue is CWE-862 and affects WordPress sites with the plugin active; no public exploit identified at time of analysis.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (versions through 4.1.26) allows unauthenticated remote attackers to bypass access controls and modify plugin-controlled data, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (low integrity impact only, no confidentiality or availability loss). This moderate-severity CWE-862 flaw requires only that the vulnerable plugin be installed and network-reachable on a WordPress site; no authentication or user interaction is needed. At time of analysis, no public exploit identified and the issue is not listed in CISA KEV.
Missing authorization in Arraytics WP Event Solution versions through 4.1.25 allows remote, unauthenticated attackers to make limited unauthorized changes under the plugin's default installation, as reflected by the integrity-only CVSS 5.3 score. The target site must have the vulnerable plugin installed and activated, and no user interaction is required; there is no KEV confirmation or public exploit code identified in the provided data. This is a moderate-to-low priority access-control flaw (CWE-862) rather than a confidentiality or availability compromise.
Missing authorization in the Arraytics Booktics WordPress plugin (versions through 1.0.28) lets an authenticated low-privilege user - such as a subscriber or customer - invoke plugin functionality that should be reserved for higher-privileged roles, resulting in limited unauthorized data disclosure and modification. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) confirms the attack is network-reachable and requires no user interaction, but an account on the target site is a hard prerequisite, and there is no availability impact. No public exploit code has been identified at time of analysis, and this is assessed as a moderate, not high-priority, issue.
Missing authorization checks in the Arraytics Booktics WordPress plugin through version 1.0.28 let unauthenticated remote attackers invoke functionality that should require elevated privileges, resulting in a limited integrity-only impact (CVSS 5.3, CWE-862). Because the CVSS vector is PR:N/UI:N, exploitation needs only network reachability of the vulnerable endpoint on a site running the plugin - no account, no victim interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity makes the flaw attractive to automated WordPress scanning and mass-exploitation tooling; risk is tempered by the plugin's small deployment footprint and the fact that confidentiality and availability are unaffected.
Missing authorization in the Booktics WordPress plugin (versions up to and including 1.0.27) allows authenticated low-privilege users to access restricted data, resulting in limited confidentiality exposure. The flaw requires a valid account on the target site but no administrative rights and no user interaction, affecting only sites with the plugin installed and activated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the CVSS score is 4.3 (moderate).
Unauthenticated broken access control in the WP Event Solution (Eventin) WordPress plugin, versions 4.1.25 and earlier, allows any remote, network-reachable attacker to reach functionality that should require authorization, with the realistic outcome bounded to low-severity exposure or manipulation of event-related data rather than full site compromise. The flaw carries a vendor-style CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N), and our independent reassessment scopes the impact to low confidentiality only, with no authentication, user interaction, or non-default configuration required. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code has been identified at time of analysis; the only public reporting is the Patchstack advisory, and the specific vulnerable endpoint is not disclosed, which limits operators' ability to target blocking rules precisely.
Missing authorization in the Arraytics Timetics WordPress plugin (versions through 1.0.63) lets remote attackers trigger plugin actions that lack proper access-control checks, allowing limited integrity and availability impact on affected sites (CVSS 6.5, CWE-862). The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L confirms exploitation is unauthenticated and requires no victim interaction, though the impact is bounded - no confidentiality loss - and any WordPress installation running the vulnerable plugin with the affected endpoint reachable is exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by Patchstack, and the affected range ends at 1.0.63.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows remote attackers to invoke functionality that should be restricted to privileged users, with the CVSS vector AV:N/AC:L/PR:N/UI:N indicating no authentication, no user interaction, and no non-default configuration are needed against a site that has the plugin installed and active. Impact is limited to integrity (C:N/I:L/A:N), so affected installations face unauthorized modification or creation of plugin-managed content rather than data disclosure or denial of service. The issue is rated moderate (CVSS 5.3) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive information disclosure in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows any remote attacker to retrieve embedded sensitive data from the plugin's exposed endpoint. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation requires no credentials, no user interaction, and no non-default configuration - only that the plugin is installed and active and the affected endpoint is network-reachable. Impact is limited to partial confidentiality loss (C:L, CVSS 5.3) with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated attackers can read, create, update, clone, and delete the email notification flows of the WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin in all versions up to and including 3.0.19, because the plugin fails to verify that a caller is authorized before processing flow-management requests (CWE-862). The exposed endpoints require no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), no user interaction, and no special configuration, since Email_Automation_Service_Provider::is_enable() unconditionally returns true and five pre-configured email flows ship with the plugin on activation; the practical result is attacker-controlled reservation confirmation, cancellation, and admin alert emails sent from the site's legitimate address, plus outright destruction of those flows. No public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); the supplied assessment rates impact as low across confidentiality, integrity, and availability and constrains the damage to the plugin's email notification subsystem rather than the wider WordPress site.
Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the `etn_shedule_objective` field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in the Booktics WordPress plugin (by Arraytics) through version 1.0.24 permits unauthenticated remote attackers to perform restricted write operations without any authentication. The CVSS vector (PR:N, I:L) confirms the flaw allows unauthorized integrity-impacting actions - such as modifying booking data or plugin state - accessible directly over the network. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized customer data modification in the Booktics WordPress plugin allows unauthenticated remote attackers to overwrite any existing customer's stored name, phone number, and linked WordPress user ID by supplying only the target's email address in a crafted REST API request. All plugin versions through 1.0.23 by Arraytics are affected, with the root cause split between a permission callback that unconditionally returns true and a guest-update function that applies caller-supplied contact data to any record whose email matches without ownership verification. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes systematic data poisoning of booking reminders, SMS notifications, and CRM integrations feasible for any attacker who can enumerate customer emails.
Authorization bypass in Eventin - Event Calendar plugin for WordPress (all versions ≤4.1.17) allows authenticated subscriber-level users to fully manage notification flow automation workflows restricted to administrators. Exploitation requires only a low-privilege WordPress account, enabling unauthorized read, create, update, clone, and delete operations on event automation configurations. No public exploit or KEV listing identified; vendor-released patch 4.1.18 resolves the flaw.
Ticket inventory exhaustion in WP Event Solution (Eventin) ≤4.1.22 allows any unauthenticated visitor to forge completed event orders and permanently lock out legitimate ticket buyers. The REST endpoint /wp-json/eventin/v2/orders relies solely on a wp_rest nonce for authorization, but that nonce is broadcast to every site visitor via the etn-public script's localized_data_obj - making the check functionally equivalent to no check at all. By submitting crafted POST requests with status='completed', attackers create persistent fake sold-order records that count against ticket inventory indefinitely, since the auto-cleanup scheduler only targets pending orders. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authorization bypass in the Eventin WordPress plugin (versions 4.0.26-4.1.15) enables unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash to the payment_complete() REST endpoint. The wp_rest nonce required to reach this endpoint is embedded in the HTML of every public event page, eliminating any credential or session requirement. This is a confirmed regression - the same function and endpoint were previously patched by Arraytics, but the fix was lost in subsequent releases; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the Eventin WordPress event management plugin (all versions through 4.1.15) lets any contributor-level user permanently embed malicious JavaScript in event FAQ sections via the unescaped `etn_faq_content` parameter. The CVSS scope change (S:C) confirms the impact crosses the attacker's security context - injected scripts execute in any visitor's browser who loads the affected event page, enabling session hijacking or credential harvesting of higher-privileged users including site administrators. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity and commonly granted contributor role make this a credible insider-threat risk on multi-user WordPress installations.
Authorization bypass in the WPCafe WordPress plugin (all versions through 3.0.14) allows any authenticated subscriber-level user to fully manage email notification flow workflows that are intended to be administrator-only. The FlowAPI REST endpoints bundled within the plugin's email notification SDK rely solely on a wp_rest nonce for access control - a token freely obtainable from the frontend page source by any logged-in user - completely bypassing role-based authorization. No public exploit or active exploitation has been identified at time of analysis, though the low exploitation complexity makes this a realistic risk on sites with open user registration.
Broken access control in the Arraytics WP Event Solution WordPress plugin through version 4.1.12 allows remote unauthenticated attackers to access protected functionality or data without authorization. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, exposing sensitive event-management capabilities or data to anyone who can reach the WordPress site. No public exploit identified at time of analysis, and the issue is not currently listed in the CISA KEV catalog.
Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user capabilities in the get_item_permissions_check() function, allowing authenticated Subscriber-level users to enumerate and read arbitrary order data including customer names, emails, and phone numbers through order ID iteration. Affected versions include all releases up to and including 4.1.8. This is a low-complexity, network-accessible vulnerability (CVSS 4.3) that requires only basic authentication, making it exploitable by any user with a WordPress account on an affected site.
Missing authorization in Arraytics Booktics WordPress plugin through version 1.0.16 allows unauthenticated remote attackers to modify application data via incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.02%, percentile 4) despite the network-accessible attack vector, suggesting limited real-world exploitation likelihood. No public exploit code or active CISA KEV status has been identified.
Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.0.23. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.