CVE-2026-32354 MEDIUM

CVE-2026-32354: WordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerability

Vendor Magepeopleteam

Product WpEvently

Weakness CWE-201

Published March 13, 2026

Last update April 29, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through < 5.1.9.

Explanation of Vulnerability in Simple Terms

02Summary

WpEvently versions 5.1.9 and earlier expose sensitive information to unauthenticated attackers over the network. An attacker can read data that should be restricted, such as event details or user information, without needing to log in or interact with a victim. The vulnerability stems from insufficient access controls on data exposure.

What an attacker can do

03Attacker Capabilities

Read sensitive event or user data without authentication.

Potential impact on your site

04Site Impact

Confidential event information or user data may be visible to anyone on the internet.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

March 13, 2026 CVE published

April 29, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-32354 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html AskarLabs — CWE-201 write-up Insertion of Sensitive Information Into Sent Data

Related vulnerabilities