This vulnerability in the Sayful Islam Upcoming Events Lists plugin (versions <= 1.4.0) allows an attacker with at least low privileges to bypass authorization controls by manipulating a user-controlled key. The flaw stems from incorrect access control configuration, potentially enabling limited integrity and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation could allow an attacker with some privileges to perform unauthorized actions that affect the integrity and availability of the system or data managed by the Upcoming Events Lists plugin. There is no confidentiality impact reported. No known active exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently documented, users should monitor for vendor updates. Until a fix is available, restricting access to trusted users and reviewing access control configurations may reduce risk.