CVE-2026-109898

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Unauthenticated attackers can exploit missing authorization checks over the network to alter plugin data or perform unauthorized actions. They do not need credentials or user interaction to trigger it.

Root cause

The plugin lacks proper authorization checks on actions with incorrectly configured access control levels.

Affected systems

Arraytics WP Event Solution (wp-event-solution) through 4.1.25

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade WP Event Solution to a version newer than 4.1.25 once released; if an update is unavailable, deactivate and remove the plugin immediately.

shell

$ wp plugin deactivate wp-event-solution

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.

References

https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-25-broken-access-control-vulnerability-3?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-109898