CVE-2025-14029 is a missing authorization vulnerability in the Community Events WordPress plugin by jackdewey. The ajax_admin_event_approval() function lacks a capability check, enabling unauthenticated users to approve events arbitrarily via the 'eventlist' parameter. This vulnerability affects all versions up to and including 1.5.6. The CVSS 3.1 score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact.

An attacker can approve arbitrary events without authentication, potentially allowing unauthorized content to appear as approved events on a WordPress site using this plugin. This impacts the integrity of event data but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider disabling the Community Events plugin or restricting access to the ajax_admin_event_approval() function through other means such as web application firewall rules or custom code to enforce authorization checks.