Event post: Authorization bypass through a user-controlled key
An attacker with low privileges, according to the CNA vector, can influence a key used for authorization so that a request reaches an operation outside the intended access boundary. The vector rates integrity impact as high without victim interaction. The export does not disclose the key name, endpoint, WordPress role, target object or exact unauthorized change. Affected versions: <= 6.1.1. The authoritative export identifies 6.1.2 as fixed for this CVE.
- Component
- Event post
- Plugin slug
event-post- Affected
- <= 6.1.1
- Safe version
6.1.2- Published
- Oct 12, 2026
This CVE was published Oct 12, 2026 and is one of 14 known issues for this plugin.
Update, patch or deactivate.
Update to 6.1.2 or a later supported release. Application-level remediation: Resolve the target object server-side and verify the acting user is authorized for that object and operation. Do not treat a supplied object key as proof of ownership.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N