CVE-2026-40776
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
In WP Event Solution versions up to 4.1.8, there is an issue with unauthenticated access that may lead to broken access control.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data or functions, potentially leading to serious security incidents.
Recommendation
It is recommended to update to the latest version of WP Event Solution to mitigate this vulnerability.
Other vulnerabilities in WP Event Solution
See all- CVE-2026-82223Medium
Unauthenticated Broken Access Control vulnerability in WP Event Solution versions up to 4.1.22. An attacker without authentication can bypass access controls.
- CVE-2026-28174Medium
Sensitive data exposure vulnerability in WP Event Solution up to version 4.1.18 allows unauthorized access to customer data.
- CVE-2026-28173High
WP Event Solution plugin versions up to 4.1.19 contain a Customer Arbitrary Content Deletion vulnerability. A user with customer role can delete arbitrary content.
- CVE-2026-66451Medium
Broken Authentication vulnerability in WP Event Solution versions up to 4.1.9 allows an unauthenticated attacker to bypass authentication mechanisms.
- CVE-2025-68045High
Versions of WP Event Solution up to 4.1.12 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.
Original NVD description (English source)
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.