CVE-2026-81761: WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Published Aug 28, 2026
·Updated
Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.
Affected Software
1 affected component
WordPress WpEvently Plugin<=5.5.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WpEvently pluginto a version that resolves this vulnerability.Fixed in 5.6.0
Event History
Aug 28, 2026
CVE Published
via MITRE·02:33 PM
Data Sourced
via MITRE·02:33 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which users are able to exploit this issue?
The issue is described as a subscriber-level broken access control vulnerability. Exploitation requires an attacker to have at least subscriber privileges.
2
Is unauthenticated exploitation possible?
No. The CVSS vector specifies PR:L, meaning low-level authenticated access is required; the vulnerability is not exploitable by an unauthenticated visitor.
3
What impact does successful exploitation have?
The reported impact is limited to confidentiality. The CVSS vector indicates low confidentiality impact and no integrity or availability impact.