CVE-2026-65486
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Event post plugin versions up to 6.0.1 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
Risk Assessment
An unauthorized user may gain access to sensitive functions or data, potentially leading to privilege escalation or information disclosure.
Recommendation
Immediately update the Event post plugin to the latest available version.
Other vulnerabilities in Event post
See all- CVE-2026-107432Medium
The Event post plugin (up to version 6.1.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they are not permitted to.
- CVE-2026-107427Medium
The Event post plugin (up to version 6.1.1) contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization by manipulating a user-controlled key. An attacker may gain access to resources or perform actions they are not authorized to.
- CVE-2025-62042Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post. This issue affects Event post: from n/a through <= 5.10.3.
Original NVD description (English source)
Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS