This vulnerability (CVE-2026-40776) in WP Event SOlution by Arraytics is classified as CWE-862 (Missing Authorization). It allows unauthenticated attackers to bypass access controls, potentially exposing sensitive information. The affected versions include all versions up to and including 4.1.8, although the exact affected versions are not explicitly stated in the input data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The vulnerability allows unauthenticated attackers to bypass authorization controls, leading to a high confidentiality impact. This means sensitive data could be exposed without requiring authentication. There is no reported impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, restricting access to the affected plugin or disabling it may reduce exposure.