This vulnerability in The Events Calendar plugin from StellarWP is due to missing authorization checks, which means that certain actions or data may be accessed or modified without proper permission validation. The affected versions include all releases up to and including 6.15.12.2. The CVSS score is 5.4 (medium), with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts integrity and availability but not confidentiality. There is no vendor advisory or patch information provided, and the product is not a cloud service.

The missing authorization vulnerability can allow an attacker with low privileges to perform unauthorized actions or cause availability issues within the affected plugin. Confidential data is not directly impacted. Since no known exploits are reported, the immediate risk appears moderate but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations where possible and limit user privileges to reduce potential exploitation impact.