CVE-2026-110380

Executive Summary

CVE-2026-110380 is a Missing Authorization (CWE-862) vulnerability in the Arraytics WP Event Solution WordPress plugin, affecting versions up to and including 4.1.26. The flaw allows an unauthenticated, remote attacker to exploit an incorrectly configured access control check, permitting limited unauthorized modification of application state or data (CVSS 5.3, Integrity: Low). Organizations running WordPress sites with this plugin—particularly those exposing event registration, ticketing, or management functionality—should treat the plugin as unpatched and apply compensating controls immediately.

Technical Analysis

The vulnerability class is Missing Authorization (CWE-862), which CWE defines as the absence of an authorization check when a user attempts to access a resource or perform an action. In the WordPress plugin context, this typically means that a REST API endpoint, admin-ajax action, or form handler executes a privileged operation without verifying that the requesting user holds a capability such as manage_options or a valid, nonce-protected session.

The NVD description states the issue "allows Exploiting Incorrectly Configured Access Control Security Levels." This phrasing indicates that a security control is present but is misconfigured—a common failure mode in WordPress plugins where a capability check exists but is applied to the wrong capability level, evaluated against user-supplied input, or bypassed when a parameter is omitted. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the vulnerable path is reachable over the network by an unauthenticated attacker with no user interaction, which strongly suggests a publicly exposed endpoint (such as a REST route or admin-ajax.php handler) that fails to enforce its authorization gate on the unauthenticated request path.

The impact metric is I:L (Integrity: Low) with C:N and A:N, meaning the vulnerability class permits modification of some subset of data but does not expose confidential information or cause denial of service. No specific endpoint, function name, parameter, or file path is disclosed in the NVD description or CNA title, and no CNA title was supplied for this record. Accordingly, no code-level function names can be asserted here without fabrication; the analysis remains at the vulnerability-class level.

Note that the CVSS base score is 5.3, which is entirely consistent with an unauthenticated missing-authorization issue that yields limited integrity impact. Because no patch evidence exists from any tracked source (patch confidence 0/4), the plugin should be assumed unpatched until the vendor publishes a fixed release.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-110380. The attack chain below is inferred strictly from the vulnerability class (CWE-862) and the CVSS vector; it does not assert specific endpoint names, function names, or parameters, because none are present in the source data.

1. Reconnaissance / target identification. An attacker enumerates WordPress sites and fingerprints installed plugins, for example by requesting publicly readable plugin assets or static files. Sites running WP Event Solution up to and including 4.1.26 are the target set. No authentication is required to identify a candidate target.

2. Triggering the flaw class. The attacker sends a crafted HTTP request to a plugin-exposed route—such as a REST API endpoint, an admin-ajax.php action handler, or a form-submission handler—that performs a privileged operation. Because the access control is incorrectly configured, the authorization check is not enforced on this request path (for example, a capability check that is missing, applied at the wrong level, or evaluated against attacker-controlled input). Per the CVSS vector (PR:N, UI:N, AC:L), no credentials or victim interaction are needed.

3. Execution method. The request carries whatever data is needed to perform the targeted action. Since the failure is one of authorization rather than input validation or memory corruption, the "payload" is simply a legitimate-looking request to the misconfigured handler, submitted without the privileges the handler was intended to require.

4. Post-exploitation impact. Successful exploitation permits limited, unauthorized modification of plugin-managed data (Integrity: Low). Given the plugin's purpose (event management, registrations, ticketing), plausible effects include tampering with event or registration records. Confidentiality and availability are not impacted per the CVSS vector, so data exfiltration and service disruption are out of scope for this specific flaw. The absence of A:H/C:H subscores further constrains the realistic blast radius.

No exploit-in-the-wild evidence, threat-actor attribution, or CISA KEV listing exists for this CVE.

Impact Assessment

• Scope of access control failure: Unauthenticated, network-reachable interaction with a plugin handler that should require authorization. CVSS AV:N/AC:L/PR:N/UI:N confirms trivial, remote, credential-less triggering.
• Integrity impact (I:L): Attackers can modify a limited set of data controlled by the affected functionality. This is the primary security consequence.
• Confidentiality (C:N) and Availability (A:N): The vector indicates no confidentiality exposure and no availability impact, bounding the blast radius for this specific issue.
• Affected systems: Any WordPress installation running WP Event Solution version 4.1.26 or earlier. Because the plugin is event/registration oriented, affected sites commonly expose public-facing forms and dynamic content, increasing the attack surface.
• Business impact: Data-integrity tampering can undermine the trustworthiness of event and registration records. In contexts where such records drive access control, ticketing, or compliance reporting, even integrity-only tampering can have downstream operational and reputational consequences.

Detection Guidance

Because no public exploit exists, the following detections are generic to the CWE-862 class in WordPress plugins and should be tuned to the site's normal traffic baseline. They target unexpected unauthenticated access to plugin routes and anomalous modification requests.

Sigma Rule

title: Potential WP Event Solution Missing Authorization Exploitation (CVE-2026-110380)
id: 6f2b9c1a-4d7e-4a8b-9c3f-110380a1b2c3
status: experimental
description: Detects unauthenticated HTTP requests targeting the wp-event-solution plugin path that may exploit missing authorization (CWE-862).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110380
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains:
      - '/wp-content/plugins/wp-event-solution/'
      - 'wp-event-solution'
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_noauth:
    cs-uri-query|contains: 'action='
  condition: selection_path and selection_method and selection_noauth
falsepositives:
  - Legitimate authenticated site administrators editing events
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.110380

YARA Rule

rule CVE_2026_110380_WP_Event_Solution_Missing_Authz
{
    meta:
        description = "Detects references to WP Event Solution plugin in web logs or captured traffic consistent with CVE-2026-110380 probing"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110380"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $p1 = "wp-event-solution" ascii nocase
        $p2 = "/wp-content/plugins/wp-event-solution/" ascii nocase
        $a1 = "action=" ascii nocase
        $a2 = "wp-json" ascii nocase

    condition:
        any of ($p*) and any of ($a*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110380 WP Event Solution potential missing authorization attempt"; flow:established,to_server; http.uri; content:"/wp-content/plugins/wp-event-solution/"; http.request_body; content:"action="; classtype:attempted-admin; sid:2026110380; rev:1; metadata:reference nvd,cve CVE-2026-110380;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http"
      and url.path : "/wp-content/plugins/wp-event-solution/*"
      and http.request.method : ("POST","PUT","PATCH") ]
  [ network where network.protocol == "http"
      and url.query : "*action=*"
      and http.response.status_code : 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower=lower(uri)
| where match(uri_lower, "wp-event-solution")
| where match(method,"POST|PUT|PATCH")
| where match(uri_lower,"action=")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip uri status
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-110380,">
  <rule id="110380" level="10">
    <if_sid>31100</if_sid>
    <id>^40[0-9]$|^20[0-9]$</id>
    <match>wp-event-solution</match>
    <regex>action=</regex>
    <description>CVE-2026-110380: Possible unauthenticated access to WP Event Solution plugin (missing authorization)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_110380,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Vendor fix: N/A. Workarounds documented by vendor: N/A. No affected-version range metadata was supplied beyond "from n/a through 4.1.26"; no OSV package data is available.

Immediate mitigations:

1. If event-management functionality is not essential, deactivate and remove the WP Event Solution plugin until a fixed release is published.
2. Where the plugin must remain active, place site-wide authorization in front of plugin routes: enforce authentication at the reverse proxy/WAF for any request path under /wp-content/plugins/wp-event-solution/ and for plugin-related REST and admin-ajax.php actions.
3. Deploy the Suricata/Sigma/Wazuh detections above and alert on POST/PUT/PATCH requests reaching plugin routes from unauthenticated sessions.
4. Apply virtual patching via WAF rules that reject modification verbs to plugin endpoints lacking a valid authenticated session.

Patch/upgrade steps:

1. Monitor the WordPress plugin repository and the Arraytics vendor channel for a release above 4.1.26 addressing CWE-862.
2. Track the NVD entry (CVE-2026-110380) for vendor advisory updates; no fixed version is currently identified.
3. Once a patched version is published, stage it in test, validate event/registration workflows, then roll out to production and confirm the version via the WordPress admin plugin page.

Long-term hardening:

1. Maintain an inventory of installed WordPress plugins and subscribe to vulnerability feeds for each; establish a routine to remediate plugins flagged as unpatched.
2. Enforce the principle of least privilege: configure roles so that only trusted users can perform event-management actions.
3. Require nonce validation and capability checks as a code-review standard for any custom or third-party plugin handling state-changing operations.
4. Deploy a WAF with a managed WordPress ruleset and enable rate limiting on plugin endpoints.
5. Continuously log and review access to plugin routes, and correlate with the detection rules provided above.

References

1. NVD — CVE-2026-110380: https://nvd.nist.gov/vuln/detail/CVE-2026-110380
2. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. WordPress Plugin Security Guidance: https://developer.wordpress.org/plugins/security/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-110380 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-110380 at the time of writing. EPSS has not been scored by FIRST.org, and no public PoC or exploit code exists.