The vulnerability identified as CVE-2025-58009 affects the CP Multi View Event Calendar plugin by codepeople, specifically versions up to 1.4.35. It is caused by missing authorization checks due to incorrectly configured access control security levels. This could allow users with high privileges to perform unauthorized actions that impact the integrity and availability of the system. The CVSS 3.1 base score is 3.8, reflecting a network attack vector with low complexity, requiring high privileges, no user interaction, and limited impact on integrity and availability but no confidentiality impact. No patch or official remediation information is currently available.

The vulnerability allows exploitation of missing authorization controls, potentially enabling users with high privileges to perform unauthorized actions that could affect system integrity and availability. Confidentiality is not impacted. The overall severity is low based on the CVSS score of 3.8. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations for the CP Multi View Event Calendar plugin to ensure proper authorization enforcement. Monitor for updates from the vendor or security advisories for any released patches.