CVE-2026-107427: WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Event post pluginto a version that resolves this vulnerability.Fixed in 6.1.2
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attack vector requires low privileges (PR:L). No user interaction is required.
Can this be exploited remotely?
Yes. The vulnerability is rated with network attack vector (AV:N) and low attack complexity (AC:L).
What is the expected security impact?
The stated impact is high integrity impact, meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is indicated.
Which releases are identified as affected?
The issue is listed as affecting Event post through version 6.1.1. The provided data does not identify a fixed version.