CVE-2026-107427
MediumCVSS 6.5Summary
The Event post plugin (up to version 6.1.1) contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization by manipulating a user-controlled key. An attacker may gain access to resources or perform actions they are not authorized to.
Risk Assessment
An organization using this plugin may be exposed to unauthorized access to data or functions, potentially leading to modification or disclosure. The risk is particularly high if the plugin manages sensitive information.
Recommendation
Update the Event post plugin to the latest version that fixes this vulnerability. If an update is not possible, consider disabling the plugin until a patch is released.
Other vulnerabilities in Event post
See all- CVE-2026-107432Medium
The Event post plugin (up to version 6.1.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they are not permitted to.
- CVE-2026-65486Medium
The Event post plugin versions up to 6.0.1 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
- CVE-2025-62042Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post. This issue affects Event post: from n/a through <= 5.10.3.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS