CVE-2026-66451

The CVSS 6.5 on this vulnerability is dangerously misleading. This is unauthenticated broken authentication in a WordPress event management plugin—meaning no credentials, no session, nothing required beyond sending a network request to the target. The CVSS framework weights authentication as a metric, but the composite score still lands in the 'medium' range that will cause automated threat intelligence pipelines to deprioritize it. That pipeline behavior is the real risk here, not the number itself. WP Event Solution versions 4.1.9 and below expose a registration system that fails to authenticate requests at the application layer. Event management plugins typically serve as data aggregation hubs: they collect registrant names, email addresses, event preferences, ticket codes, and often partial or full payment data depending on the payment processor integration. If this plugin handles EU registrant data, the GDPR Article 32 and 34 obligations apply regardless of whether exploitation has occurred—the 72-hour breach notification clock begins at exploitation, not discovery. This transforms a technical medium-severity finding into a compliance incident with legal liability attached. The active development status (four major version iterations) matters here more than the CVSS score. Actively-maintained plugins with major version transitions frequently contain authentication architecture flaws that were baked in from the initial build rather than eroded through abandonment. The refactoring that produces 4.x releases often touches auth handlers, creates hook ordering issues, or leaves deprecated endpoints live. Treat the entire auth surface of this plugin as suspect until the vendor patch is verified. The integration hub dimension compounds the technical risk. Registrant data from this plugin often connects to check-in systems, email marketing platforms, and payment processors. An attacker with registrant credentials can pivot along those integration paths—probing whether ticket codes authenticate elsewhere, or whether email addresses enable password resets on associated accounts. The blast radius extends beyond the plugin's database. Prioritize this patch regardless of the CVSS score. The EPSS metric reflects current scanning frequency, not weaponization probability—WordPress plugin vulnerabilities rated 5.0-6.5 have a documented history of rapid mass exploitation once reconnaissance scripts circulate. The remediation window for this vulnerability class follows a compounding curve: automated tooling picks up new CVEs faster than organizations deploy patches, and the 'medium' severity designation gives defenders a false sense of urgency. Assume opportunistic exploitation begins within days of public disclosure.

Reviewed through automated stages and approved by a human before publication.