CVE-2026-81802
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.
Risk Assessment
An attacker can access sensitive data or administrative functions without authentication, potentially leading to data integrity compromise or site takeover.
Recommendation
Update WpEvently to a version newer than 5.6.0 if a fix is available. Restrict access to sensitive functions and monitor logs for suspicious requests.
Other vulnerabilities in WpEvently
See all- CVE-2026-81761Medium
The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for subscribers. Subscriber-level users can gain unauthorized access to administrative functions.
- CVE-2026-81759Medium
The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.
- CVE-2026-45441High
WpEvently versions up to 5.3.3 contain an unauthenticated vulnerability that could be exploited by attackers.
- CVE-2024-32110Medium
A Cross-Site Request Forgery (CSRF) vulnerability was found in the WpEvently plugin for WordPress up to version 4.1.2. Lack of proper protections allows an attacker to perform unauthorized actions in the context of an authenticated user.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS