EUVD-2026-67731
GHSA-9mm7-6jx7-w9wg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-accessible plugin endpoint exploitable by authenticated contributor; no confidentiality impact; limited integrity and availability impact with no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Broken Access Control in WpEvently <= 5.5.0 versions.
AnalysisAI
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at minimum a Contributor-level authenticated account on the target WordPress installation running WpEvently 5.5.0 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.4 (Medium) reflects a network-exploitable flaw requiring low privilege, with limited integrity and availability impact and no confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WpEvently plugin to the version released after 5.5.0 per the Patchstack advisory; the exact patched release version is not independently confirmed from the available data beyond the boundary that 5.5.0 is vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated integrity compromise in the WpEvently WordPress plugin (versions 5.3.3 and earlier) by MagePeople allows
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the WpEvently WordPress plugin (mage-eventpress) affectin
Unauthenticated IDOR in the WpEvently WordPress plugin (versions ≤ 5.6.0) allows remote attackers with no credentials to
WpEvently versions prior to 5.1.9 inadvertently expose sensitive information in transmitted data, allowing unauthenticat
Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. Rated medium severity (CVSS 4.3), this vulnerability
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invo
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today