CVE-2026-81802: WpEvently IDOR Vulnerability in WordPress

CVE-2026-81802 Overview

CVE-2026-81802 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the WpEvently WordPress plugin (also known as mage-eventpress) in versions up to and including 5.6.0. The flaw allows unauthenticated attackers over the network to reference and manipulate objects belonging to other users without proper authorization checks. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key. Successful exploitation can compromise data integrity and availability of event records managed by the plugin. Because no authentication or user interaction is required, the vulnerability can be triggered by any remote actor with access to the target WordPress site.

Critical Impact
Unauthenticated remote attackers can access or modify event-related objects belonging to other users through predictable identifiers, undermining authorization controls in WpEvently.

Affected Products

WpEvently WordPress plugin (mage-eventpress) versions <= 5.6.0
WordPress sites running the vulnerable plugin
Any environment publishing the WpEvently plugin endpoints to untrusted networks

Discovery Timeline

2026-09-08 - CVE-2026-81802 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-81802

Vulnerability Analysis

The vulnerability resides in how the WpEvently plugin resolves object references supplied in user-controlled parameters. The plugin accepts identifiers from request input and acts on the associated records without verifying that the requester owns or has permission to access those records. This pattern matches the classic IDOR anti-pattern described in CWE-639.

Because the affected endpoints are reachable without authentication, an attacker can enumerate object identifiers and interact with resources belonging to other users. The impact bounds are limited to partial integrity and availability effects, meaning attackers can alter or disrupt specific objects rather than read arbitrary confidential data. The Exploit Prediction Scoring System places this issue in a low-probability exploitation tier, but WordPress plugin flaws are routinely weaponized by opportunistic scanners.

Root Cause

The root cause is missing authorization enforcement on request handlers that operate on user-owned objects. The plugin trusts identifiers from HTTP parameters and performs privileged operations without validating the requester's session, role, or ownership of the target object.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests to the vulnerable WpEvently endpoints, substituting object identifiers to reference records they do not own. Since no authentication is required, exploitation can be automated at scale against internet-facing WordPress sites. Refer to the Patchstack Vulnerability Report for endpoint-specific details.

No verified public exploit code is available for this issue at the time of publication.

Detection Methods for CVE-2026-81802

Indicators of Compromise

Unexpected modifications to WpEvently event records, attendee data, or booking objects without corresponding user activity in audit logs.
HTTP request bursts from a single source enumerating sequential numeric identifiers against mage-eventpress endpoints.
Requests to WpEvently plugin URLs from clients that never authenticated to the WordPress site.

Detection Strategies

Inspect web server access logs for unauthenticated requests to WpEvently plugin endpoints that include object identifier parameters such as id, event_id, or booking_id.
Deploy a WordPress-aware Web Application Firewall (WAF) rule set that flags IDOR-style parameter tampering against mage-eventpress routes.
Correlate WordPress database change events with authenticated session activity to surface unauthorized object modifications.

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward events to a central analytics platform for retention and query.
Alert on anomalous rates of 200-status responses to plugin endpoints originating from unauthenticated sessions.
Track the installed WpEvently plugin version across the estate and generate an alert whenever a host reports version 5.6.0 or earlier.

How to Mitigate CVE-2026-81802

Immediate Actions Required

Inventory all WordPress sites and identify installations running WpEvently (mage-eventpress) version 5.6.0 or earlier.
Update WpEvently to a version released after 5.6.0 that addresses the IDOR issue as soon as the vendor publishes a fix.
Restrict network exposure of vulnerable WordPress sites to trusted sources until the plugin is patched.

Patch Information

Consult the Patchstack Vulnerability Report for authoritative patch guidance and fixed version information. Apply the vendor-supplied update through the WordPress plugin manager or WP-CLI once available.

Workarounds

Temporarily disable the WpEvently plugin if the fixed version is not yet available and event functionality is not business-critical.
Deploy WAF rules that block unauthenticated requests to WpEvently endpoints handling object identifiers.
Enforce IP allowlisting or authentication proxies in front of WordPress admin and plugin endpoints where feasible.

bash

# Configuration example: use WP-CLI to check the installed WpEvently version
wp plugin get mage-eventpress --field=version

# Disable the plugin as a temporary mitigation until a patch is applied
wp plugin deactivate mage-eventpress