CVE-2026-110380: Missing Authorization in Arraytics WP Event Solution

The vulnerability identified as CVE-2026-110380 in the Arraytics WP Event Solution plugin is due to missing authorization controls. This allows attackers to bypass access control restrictions and perform unauthorized actions within the affected versions of the plugin, specifically versions prior to 4.1.27. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and an impact limited to integrity loss without confidentiality or availability impact.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions that affect the integrity of the system or data managed by the WP Event Solution plugin. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's announcements for updates. Until a fix is available, review and tighten access control configurations where possible to mitigate risk.