CVE-2026-114192
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The WpEvently plugin (versions up to 5.7.8) by Magepeople inc. contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An unauthorized user may perform actions reserved for privileged roles. This could lead to modification of event data or configuration.
Recommendation
Update the WpEvently plugin to a version later than 5.7.8. Verify user permissions and access control configuration.
Other vulnerabilities in WpEvently
See all- CVE-2026-116394Medium
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection. This issue affects WpEvently: from n/a through 5.7.9.
- CVE-2026-81802Medium
Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.
- CVE-2026-81761Medium
The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for subscribers. Subscriber-level users can gain unauthorized access to administrative functions.
- CVE-2026-81759Medium
The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.
- CVE-2026-45441High
WpEvently versions up to 5.3.3 contain an unauthenticated vulnerability that could be exploited by attackers.
- CVE-2024-32110Medium
A Cross-Site Request Forgery (CSRF) vulnerability was found in the WpEvently plugin for WordPress up to version 4.1.2. Lack of proper protections allows an attacker to perform unauthorized actions in the context of an authenticated user.
- CVE-2025-66083Medium
The WpEvently (mage-eventpress) plugin up to version 5.0.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2025-66082Medium
The WordPress plugin WpEvently (up to version 5.0.4) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This may enable unauthorized actions within the plugin.
Original NVD description (English source)
Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS