CVE-2026-40776: WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the site.

Q: What impact is indicated by the available severity data?

The supplied vector indicates network-reachable exploitation with low attack complexity and no user interaction. It indicates high confidentiality impact, with no indicated integrity or availability impact.

Q: Which installations are identified as affected?

WP Event Solution Eventin plugin versions up to and including 4.1.8 are identified as affected.

Published Jun 15, 2026

Updated

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.

Affected Software

1 affected component

WP Event Solution Eventin (WordPress plugin)<=4.1.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Eventin plugin to a version that resolves this vulnerability.
Fixed in 4.1.9

Event History

Jun 15, 2026

CVE Published

via MITRE·08:18 PM

Data Sourced

via MITRE·08:18 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the site.

What impact is indicated by the available severity data?

The supplied vector indicates network-reachable exploitation with low attack complexity and no user interaction. It indicates high confidentiality impact, with no indicated integrity or availability impact.

Which installations are identified as affected?

WP Event Solution Eventin plugin versions up to and including 4.1.8 are identified as affected.

CVE-2026-40776: WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact is indicated by the available severity data?

Which installations are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact is indicated by the available severity data?

Which installations are identified as affected?