CVE-2026-107432

5.4Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated attackers with low-level accounts can bypass access controls to read or modify unauthorized post data. They need network access to the site and valid credentials to trigger the flaw.

Root cause

The plugin fails to perform authorization checks on restricted actions or endpoints, allowing users with lower roles to execute them.

Affected systems

NOUS Ouvert Utile et Simple Event post through 6.1.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Fix & remediation

Upgrade to a version newer than 6.1.1 once released. If an update is unavailable, deactivate and uninstall the event-post plugin.

shell

$ wp plugin deactivate event-post

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.

References

https://patchstack.com/database/wordpress/plugin/event-post/vulnerability/wordpress-event-post-plugin-6-1-1-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-107432