CVE-2026-66451
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Broken Authentication vulnerability in WP Event Solution versions up to 4.1.9 allows an unauthenticated attacker to bypass authentication mechanisms.
Risk Assessment
An attacker without logging in can gain unauthorized access to administrative functions, potentially leading to full site compromise.
Recommendation
Update the WP Event Solution plugin to the latest version that includes the security fix.
Other vulnerabilities in WP Event Solution
See all- CVE-2026-28174Medium
Sensitive data exposure vulnerability in WP Event Solution up to version 4.1.18 allows unauthorized access to customer data.
- CVE-2026-28173High
WP Event Solution plugin versions up to 4.1.19 contain a Customer Arbitrary Content Deletion vulnerability. A user with customer role can delete arbitrary content.
- CVE-2025-68045High
Versions of WP Event Solution up to 4.1.12 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.
- CVE-2026-40776High
In WP Event Solution versions up to 4.1.8, there is an issue with unauthenticated access that may lead to broken access control.
Original NVD description (English source)
Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.