EUVD-2026-72645
GHSA-cjp8-gfpm-f5jv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated network-reachable IDOR with no confidentiality exposure; impact bounded to partial integrity and availability in the vulnerable system only.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.
AnalysisAI
Unauthenticated IDOR in the WpEvently WordPress plugin (versions ≤ 5.6.0) allows remote attackers with no credentials to supply user-controlled object identifiers that the plugin resolves without authorization checks, yielding partial integrity and availability impact over event-related data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only standard network access to a public-facing WordPress installation running the affected plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required (CVSS PR:N) and no special server-side configuration is needed beyond a publicly accessible WordPress installation running WpEvently ≤ 5.6.0 in its default state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects genuinely trivial reachability and zero authentication requirements, but the impact ceiling is bounded: there is no confidentiality exposure (C:N), and both integrity and availability impacts are rated Low, meaning an attacker cannot exfiltrate sensitive data or fully disable the service through this vector alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WpEvently to the first release beyond 5.6.0 once MagePeople Inc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated integrity compromise in the WpEvently WordPress plugin (versions 5.3.3 and earlier) by MagePeople allows
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the WpEvently WordPress plugin (mage-eventpress) affectin
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated u
WpEvently versions prior to 5.1.9 inadvertently expose sensitive information in transmitted data, allowing unauthenticat
Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. Rated medium severity (CVSS 4.3), this vulnerability
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today