CVE-2026-105073
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution allows retrieving embedded sensitive data. This issue affects WP Event Solution from n/a through 4.1.25.
Risk Assessment
An unauthorized person may gain access to sensitive system data, potentially leading to confidentiality breach and aiding further attacks.
Recommendation
Update WP Event Solution to the latest version with the fix. Review permission configuration to restrict access to sensitive information.
Other vulnerabilities in WP Event Solution
See all- CVE-2026-109898Medium
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Event Solution: from n/a through 4.1.25.
- CVE-2026-82223Medium
Unauthenticated Broken Access Control vulnerability in WP Event Solution versions up to 4.1.22. An attacker without authentication can bypass access controls.
- CVE-2026-97300Medium
The vulnerability allows unauthenticated broken access control in WP Event Solution versions up to 4.1.25.
- CVE-2026-103684Medium
Missing Authorization vulnerability in Arraytics WP Event Solution allows exploiting incorrectly configured access control security levels. This issue affects WP Event Solution from n/a through 4.1.25.
- CVE-2026-28174Medium
Sensitive data exposure vulnerability in WP Event Solution up to version 4.1.18 allows unauthorized access to customer data.
- CVE-2026-28173High
WP Event Solution plugin versions up to 4.1.19 contain a Customer Arbitrary Content Deletion vulnerability. A user with customer role can delete arbitrary content.
- CVE-2026-66451Medium
Broken Authentication vulnerability in WP Event Solution versions up to 4.1.9 allows an unauthenticated attacker to bypass authentication mechanisms.
- CVE-2025-68045High
Versions of WP Event Solution up to 4.1.12 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.
- CVE-2026-40776High
In WP Event Solution versions up to 4.1.8, there is an issue with unauthenticated access that may lead to broken access control.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS