CVE-2026-86795: Community Events < 1.6.0 - Unauthenticated Pending Events Disclosure via ajax_admin_event_list

Q: Who can exploit this issue?

Any unauthenticated user can invoke the affected AJAX action. No login, authorization, or nonce is required.

Q: What information can be exposed?

The issue exposes details of event submissions that are awaiting moderation. These pending submissions are not otherwise available on the public site.

Q: Which installations are affected?

Community Events versions before 1.6.0 are affected. Updating to version 1.6.0 or later addresses the affected AJAX action.

Published Nov 5, 2026

Updated

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user can invoke the affected AJAX action. No login, authorization, or nonce is required.

What information can be exposed?

The issue exposes details of event submissions that are awaiting moderation. These pending submissions are not otherwise available on the public site.

Which installations are affected?

Community Events versions before 1.6.0 are affected. Updating to version 1.6.0 or later addresses the affected AJAX action.

CVE-2026-86795: Community Events < 1.6.0 - Unauthenticated Pending Events Disclosure via ajax_admin_event_list

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Which installations are affected?