The vulnerability identified as CVE-2025-30887 affects the magepeopleteam WpEvently plugin up to version 4.2.9. It is a missing authorization flaw that results from incorrectly configured access control security levels, allowing unauthorized users to perform actions that require higher privileges. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits are reported in the wild, and no patch or official remediation guidance is currently available.

This vulnerability allows unauthorized modification of data or actions within the WpEvently plugin due to missing authorization checks. It does not compromise confidentiality or availability but can affect data integrity. The medium CVSS score reflects a moderate risk that could be leveraged by remote attackers without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to unauthorized actions. Avoid exposing the plugin to untrusted users or networks.