The bastho Event post plugin for WordPress contains an improper access control vulnerability (CWE-284) in the save_bulkdatas function. This function lacks a proper capability check, enabling authenticated users with subscriber or higher roles to update post metadata in bulk. The vulnerability affects all versions up to and including 5.9.4. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. There is no indication of known exploits in the wild or available patches at this time.

An attacker with subscriber-level access or higher can update post metadata in bulk without proper authorization. This could lead to unauthorized data manipulation within the WordPress site, potentially affecting site content or behavior that relies on post meta data. There is no direct impact on confidentiality or availability reported, only integrity is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities where possible and monitor for unusual post meta data changes. Avoid granting unnecessary privileges to authenticated users. Follow updates from the bastho plugin vendor for an official patch or temporary fix.