CVE-2026-81759 MEDIUM

CVE-2026-81759: WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability

Vendor Magepeople Inc.
Product WpEvently
Weakness CWE-862 · Missing authorization
Published August 28, 2026
Last update August 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Contributor Broken Access Control in WpEvently <= 5.5.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WpEvently through version 5.5.0 fails to properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify data or disrupt site functionality without authorization. The vulnerability does not expose sensitive information but can compromise data integrity and availability.

What an attacker can do

03Attacker Capabilities

Modify or delete data and disrupt site functionality without proper authorization.

Potential impact on your site

04Site Impact

Unauthorized users can alter event data or cause service disruptions on your site.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site.

Key dates

06Disclosure timeline

August 28, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-19801 BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action CVE-2026-18431 Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write CVE-2026-73377 WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability CVE-2026-66454 WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability CVE-2026-81272 WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability