WP Event Manager EUVD-2026-95728

Requires a valid authenticated WordPress account with at least low privileges (PR:L) on a site running WP Event Manager version n/a through 3.4.1; practical exploitation is most relevant where the site allows open user registration or has multiple semi-trusted users. The missing authorization check lets such a user reach plugin functionality or data beyond their role. Exploitation is LIMITED by the need for authentication (it is not remote-unauthenticated) and by the impact scope - confidentiality and integrity are only partial (C:L/I:L) with no availability impact; sites with no untrusted registered users face substantially lower practical risk.

This is a medium-severity (CVSS 5.4) Missing Authorization flaw (CWE-862) in the WP Event Manager WordPress plugin, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates network-reachable, low-complexity exploitation that requires an authenticated low-privilege account (PR:L), no user interaction, with only partial confidentiality and integrity impact and no availability impact - consistent with a broken-access-control issue where an under-privileged user can reach functions/data intended for higher roles. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency is therefore moderate rather than critical. The signals are internally consistent (authenticated, limited-impact access control bug), so this reads as a genuine-but-not-emergency issue: patch in normal cycles, prioritizing sites that allow untrusted user registration. Note the input tag 'Authentication Bypass' conflicts with the actual CWE-862/broken-access-control nature and the PR:L requirement (which means authentication is NOT bypassed) - treat the tag, not the CWE, as the likely error.

On a WP Event Manager site (≤3.4.1) that permits self-registration or has any low-privilege accounts, an attacker logs in as an ordinary user and sends requests to plugin endpoints that fail to verify the caller's role or ownership. Because of the missing authorization check, they read or modify event data or settings they should not be able to access. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or conditions are needed once authenticated.