The vulnerability identified as CVE-2025-66082 affects the WpEvently plugin by magepeopleteam, specifically versions up to and including 5.0.4. It is caused by missing authorization checks, leading to incorrectly configured access control security levels. This allows an unauthenticated attacker to access certain data or functionality that should be restricted. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, no user interaction, and impact limited to confidentiality. There is no available patch or vendor advisory detailing remediation at this time.

The vulnerability allows unauthorized access to certain information or functionality within the WpEvently plugin, potentially leading to limited confidentiality loss. There is no impact on integrity or availability. Since the attack vector is network-based and requires no privileges or user interaction, exploitation could be straightforward if an attacker is aware of the vulnerability. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from magepeopleteam. Implementing additional access control measures at the environment level may help reduce risk, but no vendor-provided mitigation is currently documented.