CVE-2026-105073: Exposure of Sensitive System Information to an Unauthorized Control Sphere in Arraytics WP Event Solution

The vulnerability identified as CVE-2026-105073 in Arraytics WP Event Solution (wp-event-solution) permits exposure of sensitive system information to unauthorized actors. Specifically, it allows retrieval of embedded sensitive data without requiring privileges or user interaction. The affected versions include all releases prior to 4.1.26. The CVSS v3.1 base score is 5.3, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality is impacted with limited data exposure, but integrity and availability are not affected.

An attacker can remotely access sensitive system information embedded within the WP Event Solution plugin without authentication. This exposure could aid further attacks or information gathering but does not directly affect system integrity or availability.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for unusual activity related to information disclosure.