WpEvently EUVD-2026-109296

The affected software is the WpEvently (mage-eventpress) WordPress plugin, versions up to and including 5.7.8. The CVSS vector (PR:N/UI:N/AV:N/AC:L) indicates an unauthenticated attacker can reach the vulnerable functionality remotely over HTTP with no user interaction against a site running the plugin. However, the available sources do NOT name the exact endpoint, action, parameter, or configuration required to trigger the missing-authorization check, so the precise prerequisite (specific feature or plugin mode) is not described in the available sources. The primary limiting factor is deployment scope: exploitation requires the target WordPress site to have the WpEvently plugin installed and active at version 5.7.8 or earlier; impact is bounded to low confidentiality and low integrity (no availability impact) per the CVSS vector.

This is a medium-severity (CVSS 6.5) missing-authorization flaw (CWE-862) in the WpEvently / mage-eventpress WordPress plugin. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates a network-reachable, low-complexity issue requiring no privileges and no user interaction, with low confidentiality and low integrity impact and no availability impact - consistent with a broken-access-control bug that exposes or lets an unauthenticated actor manipulate some plugin data it should not. The decision signals are modest and non-urgent: the vuln.today priority is 'this_month' (not act_now/emergency), the vulnerability is NOT in CISA KEV, no EPSS exploitation-probability score is supplied, and no proof-of-concept or exploit reference is provided - only the Patchstack database entry that catalogs the issue. Exploitation status is therefore: no public exploit identified at time of analysis. There is no conflict between signals, but there is a notable DATA GAP: the description is generic ('allows Exploiting Incorrectly Configured Access Control Security Levels') and names no specific endpoint, parameter, or function, so the precise mechanism and exact data exposed cannot be verified from the available sources. Overall this is a real but moderate-priority issue - appropriate for scheduled patching rather than emergency response - driven by the unauthenticated network vector rather than by any evidence of active exploitation or wide weaponization.

An unauthenticated remote attacker sends a crafted request to a WpEvently plugin endpoint that fails to enforce an authorization check, allowing them to read or alter event-related data they should not have access to. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, special timing, or victim interaction are required. No public exploit code or PoC is identified in the provided sources, so exploitation would require an attacker to independently identify the unprotected function.