What is the CVSS score of CVE-2026-45441?

CVE-2026-45441 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-45441?

Within 24 hours: Scan WordPress instances to identify installations running WpEvently versions 5.3.3 and earlier; document asset inventory and criticality. Within 7 days: Deploy interim compensating controls (WAF rules targeting plugin endpoints, restrict plugin access to authenticated users). Within 30 days: Upgrade to WpEvently version 5.3.4 or later once released by MagePeople, or migrate to an alternative event management plugin with active security support.

WpEvently CVE-2026-45441

Q: Which versions of WpEvently are affected by CVE-2026-45441?

WpEvently WordPress plugin (versions 5.3.3 and earlier) contains an unauthenticated vulnerability allowing remote attackers to alter application data without authorization or user interaction.

EUVD-2026-36842 HIGH

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-06-15 Patchstack

GHSA-2xc5-qjqv-qjrp

WordPress Information Disclosure Wpevently Wordpress Plugin Magepeople Inc

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Fingerprint WordPress site running WpEvently
Delivery

Identify vulnerable plugin endpoint
Exploit

Send crafted request with out-of-range input
Execution

Bypass quantity/range validation (CWE-1284)
Impact

Modify stored plugin data with integrity impact

Vulnerability Assessment

Weakness	CWE CWE-1284 ASVS 5.0 V2 - Validation and Business Logic Input size validation
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site running the WpEvently (Mage Eventpress) plugin at version 5.3.3 or earlier, per CVSS AV:N/AC:L/PR:N/UI:N. Limiting factors: the plugin must be installed and activated (it is not a core WordPress component), the vulnerable endpoint must be reachable (sites that gate /wp-json or admin-ajax behind a WAF or IP allowlist reduce exposure), and the impact is constrained to integrity (I:H) - confidentiality and availability are unaffected per the vector, so this is a data-modification flaw rather than a takeover or data-theft primitive.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N) yields 7.5 and signals an internet-reachable, low-complexity, unauthenticated write/modify primitive - a profile that historically draws opportunistic scanning of WordPress plugin estates. However, several signals are weak or contradictory and warrant caution: the Patchstack tag is 'Information Disclosure' yet the vector shows C:N and I:H, which are inconsistent (information disclosure would normally be C:H, I:N) - one of the two classifications is likely wrong, and defenders should not rely on either as authoritative. No EPSS score, KEV listing, or SSVC decision data was provided, and the only reference is the Patchstack database stub, so exploitation likelihood cannot be quantified. Treat as a credible mid-tier WordPress plugin advisory rather than a confirmed urgent threat until the specific affected endpoint and patched version are published.
Exploit ScenarioDerived	An attacker enumerates WordPress sites running the WpEvently plugin via plugin-path fingerprinting, then sends a single crafted HTTP request to an unauthenticated plugin endpoint supplying an out-of-range numeric value (for example a negative or overflowing ticket quantity, attendee index, or order identifier) to manipulate stored event, booking, or order records. Because the change is server-side and unauthenticated, this can be performed at scale against indexed WordPress installations; no public PoC was identified at the time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 15, 2026

Unauthenticated integrity compromise in the WpEvently WordPress plugin (versions 5.3.3 and earlier) by MagePeople allows remote attackers to alter application data over the network without privileges or user interaction. The vendor-supplied description is a Patchstack placeholder ('Other Vulnerability Type') and does not identify the specific endpoint or function, but the CVSS vector indicates high integrity impact with no confidentiality or availability impact. No public exploit identified at time of analysis.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack record (https://patchstack.com/database/wordpress/plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-3-3-other-vulnerability-type-vulnerability) lists 5.3.3 as the latest affected version without naming a fixed release, so administrators should monitor the MagePeople plugin page on WordPress.org and upgrade to any release greater than 5.3.3 as soon as it is published. Until a fix ships, compensating controls include deactivating the WpEvently plugin on sites that do not actively use event management (eliminates exposure but removes ticketing functionality), restricting access to plugin REST and admin-ajax endpoints (e.g., /wp-json/wpevently/* and admin-ajax.php actions prefixed with wpevently or mep_) at a WAF or reverse proxy (may block legitimate front-end booking actions), and enabling Patchstack or Wordfence virtual patching for this CVE (depends on vendor signature coverage and an active subscription).

Affected VersionsENISA

WpEvently n/a ≤5.3.3

Affected Packages

euvd wpevently no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WpEvently (CPE cpe:2.3:a:magepeople_inc.:wpevently) is the MagePeople 'Mage Eventpress' event management plugin for WordPress, used to publish, sell, and manage event tickets and bookings. CWE-1284 (Improper Validation of Specified Quantity in Input) describes a class where the application accepts user-supplied values representing counts, indexes, or sizes without validating they fall within expected ranges - common in event/ticketing logic for fields such as ticket quantity, seat count, price, or attendee identifiers. Combined with PR:N, this typically points to an unauthenticated REST or admin-ajax endpoint that processes a numeric parameter the plugin trusts to be bounded.

Know when Wpevently gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI 7.5 HIGH

Unauthenticated network-reachable WordPress plugin endpoint with no user interaction; CWE-1284 input-validation flaw modifies stored data (I:H) without disclosure or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

DescriptionCVE.org

Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.

Executive ViewAI

Why It Matters

WpEvently WordPress plugin (versions 5.3.3 and earlier) contains an unauthenticated vulnerability allowing remote attackers to alter application data without authorization or user interaction. Organizations using this plugin on public-facing WordPress sites face uncontrolled data manipulation risks, with potential impact to event data integrity and user-facing content. Remediation is urgent because no patch is currently available from the vendor.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable WpEvently plugin if operationally feasible and migrate managed data to alternative solution; (2) Restrict plugin functionality to authenticated, authorized users via WordPress role-based access controls; (3) Implement Web Application Firewall rules to block POST/PUT/PATCH requests to WpEvently endpoints from untrusted networks; (4) Enable detailed WordPress audit logging to detect and alert on unauthorized data modifications; (5) Subscribe to MagePeople security announcements for patch release notification.

Threat Intelligence Overview

EPSS Score

0.3%

Top 83% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.