CVE-2026-28173

CVE-2026-28173 in WP Event Solution plugin (versions <= 4.1.19) is an IDOR vulnerability in the content deletion pathway that earns its CVSS 7.1 through what it allows rather than what it breaks. Any authenticated user—subscriber, customer, registered attendee—can delete arbitrary content by ID without proving ownership. The 'arbitrary' qualifier in the CVE title is the signal: this isn't a deletion handler scoped to event data, it's one that accepts content IDs without verifying they're within the plugin's namespace. The root cause is a common WordPress failure mode: developers implement `current_user_can('subscriber')` or similar and believe they've secured the endpoint. They haven't—they've verified identity, not authorization. The plugin knows you're logged in; it never checks whether the content you're attempting to delete belongs to you. That's the gap an attacker exploits. Your first action: identify the deletion handler. In WordPress plugins, this typically registers via `add_action('wp_ajax_nopriv_...')` or `wp_ajax_...` hooks. Search for callback functions that invoke `wp_delete_post()`, `wp_delete_attachment()`, or direct database DELETE operations on any ID passed via `$_POST` or `$_GET`. If the handler accepts a raw ID parameter and passes it to a WordPress native deletion function without a preceding ownership check—`get_post_field('post_author', $id) == get_current_user_id()` or equivalent— you're looking at the vulnerability. The blast radius question matters more than the CVSS suggests. If this handler touches WordPress native posts rather than custom plugin tables, an authenticated attacker with subscriber-level access can delete posts, pages, or attachments anywhere on the site. That changes the severity profile from 'plugin bug' to 'privilege escalation pathway.' You need to confirm whether the handler queries `wp_posts` or only plugin-specific tables. The EPSS score (0.00226) is a temporal snapshot—it tells you exploitation probability is low right now, not that it stays low. Disclosure triggers scanner adoption; the window where 'low probability' holds closes fast. Patch now, not when the EPSS moves. If you cannot patch immediately, disable the deletion endpoint at the web server level (block the relevant AJAX action) or remove the callback registration entirely via a site-specific plugin. Monitoring for DELETE requests to admin-ajax.php with unusual ID sequences will catch exploitation attempts in the interim.

Reviewed through automated stages and approved by a human before publication.