CVE-2026-62041
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The WP Event Manager plugin by Ashok Dudhat through version 3.4.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects WP Event Manager from n/a through 3.4.1.
Risk Assessment
The risk includes unauthorized access to event management functionality, which could lead to data breaches or unauthorized changes.
Recommendation
It is recommended to update the WP Event Manager plugin to a patched version and review access control configuration.
Other vulnerabilities in WP Event Manager
See all- CVE-2026-86442Unknown
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or post type of a user-supplied post identifier in its front-end event submission flow. This allows unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages and convert them into events.
- CVE-2026-16304Unknown
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or type of user-supplied post identifiers processed by one of its frontend forms. This allows any user with a Subscriber account or above to reassign authorship of arbitrary posts to themselves and force them to be published, resulting in content takeover and public disclosure of private or draft content; the relevant frontend feature must be enabled.
Original NVD description (English source)
Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS