CVE-2026-107432
MediumCVSS 5.4Summary
The Event post plugin (up to version 6.1.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they are not permitted to.
Risk Assessment
An organization using this plugin may be exposed to unauthorized operations on data, potentially leading to modification or disclosure. The risk is particularly high if the plugin has access to sensitive WordPress functions.
Recommendation
Update the Event post plugin to the latest version that fixes this vulnerability. If an update is not possible, consider disabling the plugin until a patch is released.
Other vulnerabilities in Event post
See all- CVE-2026-107427Medium
The Event post plugin (up to version 6.1.1) contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization by manipulating a user-controlled key. An attacker may gain access to resources or perform actions they are not authorized to.
- CVE-2026-65486Medium
The Event post plugin versions up to 6.0.1 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
- CVE-2025-62042Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post. This issue affects Event post: from n/a through <= 5.10.3.
Original NVD description (English source)
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS