WpEvently CVE-2026-81759

Exploitation requires the attacker to hold at minimum a Contributor-level authenticated account on the target WordPress installation running WpEvently 5.5.0 or earlier. The CVSS PR:L metric confirms authentication is required - unauthenticated remote exploitation is not possible. Sites with open user registration that automatically assigns the Contributor role face the broadest exposure, as any registered user could exploit this. Sites where Contributor accounts are tightly controlled, or where WpEvently is installed but no external users hold Contributor access, face significantly reduced practical risk. No special plugin configuration or non-default settings are indicated as prerequisites beyond the plugin being active.

The CVSS 3.1 score of 5.4 (Medium) reflects a network-exploitable flaw requiring low privilege, with limited integrity and availability impact and no confidentiality impact. The practical risk is constrained: an attacker must already hold a Contributor-level WordPress account on the target site, limiting opportunistic exploitation to scenarios where open registration with Contributor assignment is enabled. EPSS data is not provided in the available intelligence, so exploitation probability cannot be quantified. No KEV listing and no POC code have been identified, indicating this remains a theoretical risk rather than an active threat. The scope is unchanged, meaning successful exploitation does not pivot to other systems. Overall, this is a real but low-urgency issue - highest risk on sites with open user registration granting Contributor roles, or where multiple untrusted contributors are present.

An attacker who has registered or obtained a Contributor-level account on the target WordPress site sends a crafted HTTP request to an inadequately protected WpEvently plugin endpoint - such as an admin-ajax.php action or REST API route - that performs a privileged operation without validating the caller's capability. The attacker can thereby modify event data, delete records, or disrupt plugin functionality beyond what a Contributor role should permit. No public exploit code has been identified, so this requires manual discovery of the unprotected endpoint.