CVE-2026-81759: WpEvently Auth Bypass Vulnerability

CVE-2026-81759 Overview

CVE-2026-81759 is a broken access control vulnerability in the WpEvently (mage-eventpress) WordPress plugin, affecting versions 5.5.0 and earlier. The flaw allows authenticated users at the Contributor role level to perform actions that should require higher privileges. The weakness is classified as [CWE-862] Missing Authorization, indicating that the plugin fails to enforce authorization checks on one or more sensitive functions. Successful exploitation can lead to limited integrity and availability impact on the affected WordPress site. The vulnerability was published to the National Vulnerability Database (NVD) on August 28, 2026.

Critical Impact
Authenticated Contributor-level users can bypass authorization controls in WpEvently to alter plugin data outside their intended permissions.

Affected Products

WpEvently (mage-eventpress) WordPress plugin versions <= 5.5.0
WordPress sites permitting Contributor-role registration with WpEvently installed
Any deployment of the mage-eventpress plugin below the fixed release

Discovery Timeline

2026-08-28 - CVE-2026-81759 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-81759

Vulnerability Analysis

CVE-2026-81759 is a Broken Access Control vulnerability in the WpEvently plugin for WordPress. The plugin exposes functionality that does not adequately verify the calling user's capabilities before executing privileged actions. As a result, a user with only the Contributor role can invoke operations reserved for higher-privileged roles such as Editor or Administrator.

According to the Patchstack Vulnerability Report, the issue affects releases up to and including version 5.5.0. Because Contributor accounts can be created through self-registration on many WordPress sites, the barrier to exploitation is low once registration is enabled.

The vulnerability provides limited confidentiality impact but permits unauthorized modification of plugin-managed data and potential disruption of event content. Exploitation is remote and requires authentication as a low-privileged user.

Root Cause

The root cause is missing authorization ([CWE-862]) on one or more plugin endpoints or action handlers. The plugin logic assumes callers have appropriate capabilities without invoking WordPress capability checks such as current_user_can() or verifying the request context with check_ajax_referer(). This design gap lets Contributor accounts reach code paths intended for privileged administrators.

Attack Vector

An attacker first obtains or registers a Contributor account on a WordPress site running a vulnerable WpEvently version. The attacker then issues authenticated HTTP requests to plugin action endpoints that lack capability enforcement. The endpoint executes the requested operation because it does not verify the caller's role, resulting in unauthorized data modification.

The vulnerability manifests through plugin actions that do not enforce capability checks. Refer to the Patchstack advisory for endpoint-level technical details.

Detection Methods for CVE-2026-81759

Indicators of Compromise

Unexpected modifications to WpEvently events, categories, or plugin settings performed by Contributor-level accounts.
WordPress wp-admin/admin-ajax.php or admin-post.php requests from Contributor sessions targeting WpEvently action handlers.
New or altered plugin-managed content that does not correspond to legitimate editorial workflows.

Detection Strategies

Audit WordPress user activity logs for privileged actions attributed to Contributor accounts.
Review web server access logs for POST requests to WpEvently admin endpoints originating from low-privilege users.
Correlate plugin database changes with the acting user's role using WordPress audit-logging plugins.

Monitoring Recommendations

Enable a WordPress activity log covering role assignments, plugin actions, and content mutations.
Alert on Contributor accounts triggering AJAX actions associated with the mage-eventpress plugin.
Track anomalous account creations and role transitions during periods of unusual event data changes.

How to Mitigate CVE-2026-81759

Immediate Actions Required

Update WpEvently (mage-eventpress) to a version later than 5.5.0 once the vendor releases a patched build.
Disable open user registration or restrict the default new-user role to Subscriber if not required.
Review existing Contributor accounts and remove any that are unrecognized or unused.

Patch Information

Consult the Patchstack Vulnerability Report for the current fixed-version status and vendor advisory details. Apply the fixed release through the WordPress plugin updater as soon as it is available.

Workarounds

Deactivate the WpEvently plugin until an updated version is installed if event functionality is not business critical.
Restrict access to wp-admin and admin-ajax.php using web application firewall rules that enforce role-based request filtering.
Temporarily downgrade or remove Contributor-role accounts that do not require ongoing publishing access.

bash

# Configuration example
# Set the default WordPress registration role to Subscriber via wp-cli
wp option update default_role subscriber

# List and audit Contributor-role accounts
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered