CVE-2026-109898: WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
Published Oct 13, 2026
·Updated
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
Affected Software
1 affected component
Arraytics WP Event Solution<=4.1.25
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arraytics WP Event Solutionto a version that resolves this vulnerability.Fixed in 4.1.26
Event History
Oct 13, 2026
CVE Published
via MITRE·04:23 PM
Data Sourced
via MITRE·04:23 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an account or user interaction?
No. The CVSS vector indicates that the issue is remotely exploitable with no privileges required and no user interaction.
2
What security impact is indicated by the available scoring data?
The scoring indicates a low integrity impact. No confidentiality or availability impact is indicated.
3
Which plugin installations should be considered affected?
WP Event Solution installations through version 4.1.25 are identified as affected. The available data does not provide a fixed version or workaround.