Description

Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-10-12T08:17:18.703Z",
  "pubdate": "2026-10-12T08:17:18.703Z",
  "executiveSummary": "A missing authorization vulnerability has been identified in the NOUS Ouvert Utile et Simple Event post plugin for WordPress, specifically affecting versions from n/a through 6.1.1.\nThis vulnerability is classified as an Incorrectly Configured Access Control issue, where the plugin fails to properly validate the authorization levels of users performing sensitive operations related to event posts.\nThe flaw allows unauthorized actors to exploit broken access control mechanisms, potentially leading to unauthorized modification, deletion, or creation of event data.\nThe risk implication is significant as it compromises the integrity and confidentiality of event management within the affected environment.\nAttackers do not require specific high-level privileges to initiate an exploit, as the vulnerability resides in the improper implementation of capability checks on event post functionalities.\nSuccessful exploitation allows an attacker to perform actions they are not permitted to access, bypassing intended security constraints configured within the application.",
  "technicalDetails": "The vulnerability originates from a failure in the NOUS Ouvert Utile et Simple Event post plugin to implement robust server-side authorization checks on the endpoints responsible for handling event post requests.\nThe root cause is an insecure implementation of access control logic within the plugin's codebase. Specifically, the affected functions or API handlers lack the necessary WordPress capability checks (e.g., current_user_can()) before executing sensitive actions.\nWhen a request is made to an event post endpoint, the application performs the requested action based on input parameters without verifying if the requesting user possesses the required administrative or editor privileges.\nThe attack flow begins with an unauthorized or authenticated user with low privileges constructing a malicious HTTP request directed at the Event post functionality.\nSince the plugin does not validate the user's role or permissions for these specific actions, the server processes the request as if it originated from a legitimate, authorized user.\nExploitation allows the attacker to interact with event post data arbitrarily. This might include creating new events, modifying existing events, or deleting event content, despite the attacker lacking the legitimate permissions to perform such operations.\nThe vulnerability affects all versions of Event post from the initial release up to and including version 6.1.1.\nThe exposure is network-based; any actor capable of interacting with the WordPress installation can potentially trigger the vulnerable endpoints if they are accessible via the web interface.\nThe payload behavior involves the transmission of crafted requests to the plugin's event management interface. By bypassing the intended access control security levels, the attacker effectively escalates their privileges regarding event management operations.\nPost-exploitation impact includes unauthorized data modification, potential defacement of the event calendar, and the subversion of internal workflows managed by the Event post plugin, leading to a complete compromise of the plugin's configured access control policy."
}