WpEvently CVE-2026-81761

Exploitation requires the attacker to hold at minimum a WordPress Subscriber account on the target site, confirmed by the CVSS PR:L metric. On WordPress sites with open user registration enabled (Settings > General), any unauthenticated visitor can self-register as a Subscriber, effectively reducing the practical barrier. The WpEvently plugin must be installed and active on the site. Impact is bounded to confidentiality only (C:L) - the attacker cannot modify data or cause a denial of service through this flaw alone. Sites that disable open registration, require administrator approval for new accounts, or do not use WpEvently are not exposed. Exploitation is also limited to the data and functionality accessible within WpEvently's scope; lateral movement to broader WordPress admin functionality is not indicated by the available data.

The CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible flaw requiring low privileges (PR:L) with low confidentiality impact and no integrity or availability impact. The PR:L requirement is the most significant limiting factor: exploitation is gated behind possession of at minimum a WordPress Subscriber account, which meaningfully restricts opportunistic exploitation compared to unauthenticated flaws. Sites with open user registration - where any visitor can self-register as a Subscriber - are most exposed. No CISA KEV listing and no public exploit code identified at time of analysis; EPSS data was not provided in the input. The unchanged scope (S:U) and C:L impact confirm this is an information disclosure class issue, not a site takeover vector. Real-world risk is best characterized as moderate for open-registration sites and low for sites with closed or curated user enrollment.

An attacker registers a free WordPress Subscriber account on the target site - trivially possible on any site with open registration - then crafts HTTP requests targeting WpEvently plugin endpoints or AJAX actions that lack authorization checks, accessing event data or configurations intended for Editor or Administrator roles. No public exploit code has been identified at time of analysis, but the well-understood CWE-862 class and low attack complexity make independent exploitation straightforward for any attacker familiar with WordPress plugin internals.