{"id":"CVE-2026-110380","kind":"vulnerability","aliases":["CVE-2026-110380"],"related":[],"title":"WP Event Solution WordPress plugin: missing authorization check through 4.1.26","description":"Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.","summary":"WP Event Solution, a WordPress event plugin by Arraytics, has a missing authorization check in versions through 4.1.26. An attacker may reach functions that should be restricted to privileged users.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-event-solution"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-event-solution --field=version`\n- unknown for other checks; the sources do not say which endpoints are affected","fix":"- Update WP Event Solution to a version later than `4.1.26`\n- unknown for a patched version number; the sources do not give one","status":"open","published_at":"2026-10-16T13:16:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:22+00:00","updated_at":"2026-10-25T04:27:22+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:27:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Event Solution to a version later than `4.1.26`\n- unknown for a patched version number; the sources do not give one","reach":"internet","title":"WP Event Solution WordPress plugin: missing authorization check through 4.1.26","impact":"medium","summary":"WP Event Solution, a WordPress event plugin by Arraytics, has a missing authorization check in versions through 4.1.26. An attacker may reach functions that should be restricted to privileged users.","category":"package","nicknames":[],"who_cares":["wordpress","wp-event-solution","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to restricted plugin functions on the site","analyst_note":"Check the NVD entry and the Wordfence or plugin changelog for the affected functions, required privilege, and the fixed version.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-event-solution --field=version`\n- unknown for other checks; the sources do not say which endpoints are affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WP Event Solution at version 4.1.26 or earlier are in scope. The sources do not say which functions lack the check or whether an account is needed, so sites with the plugin installed should treat themselves as potentially exposed. Sites without the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000601,"input_tokens":3309,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110380':13A,16A '-2026':12A,15A '4.1.26':10A,43B,84C 'access':72C 'affect':77C 'allow':68C 'arrayt':34B,60C 'attack':45B 'author':7A,38B,57C 'check':8A,39B 'configur':71C 'control':73C 'cve':11A,14A 'event':2A,24B,27B,31B,62C,66C,79C 'exploit':69C 'function':48B 'host':20B 'incorrect':70C 'issu':76C 'levels.this':75C 'may':46B 'miss':6A,37B,56C 'n/a':82C 'packag':17B 'plugin':5A,32B 'privileg':54B 'reach':47B 'restrict':52B 'secur':74C 'self':19B 'self-host':18B 'solut':3A,25B,28B,63C,67C,80C 'user':55B 'version':41B 'vulner':58C 'wordpress':4A,21B,30B 'wp':1A,23B,26B,61C,65C,78C 'wp-event-solut':22B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running WP Event Solution at version 4.1.26 or earlier are in scope. The sources do not say which functions lack the check or whether an account is needed, so sites with the plugin installed should treat themselves as potentially exposed. Sites without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110380","severity":null,"published_at":"2026-10-16T13:16:54+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}