Quick answers
- Is CVE-2026-81759 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81759 being exploited in the wild.
- How severe is CVE-2026-81759?
- Medium severity, with a CVSS score of 5.4, published 28 August 2026.
- Which products and versions are affected?
- MagePeople WpEvently <=5.5.0.
- Is there a fix for CVE-2026-81759?
- A patch was published on 2026-08-27: Fix available in version 5.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81759 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-81759?
- Check whether you run MagePeople WpEvently at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a broken access control vulnerability (OWASP A1) in WpEvently versions up to 5.5.0 where insufficient authorization checks allow authenticated users with contributor role to access sensitive functionality or data. The vulnerability is triggered by an authenticated attacker with contributor-level privileges on the WordPress site. The attack requires no network access beyond normal WordPress authentication and no user interaction from administrators. An attacker can bypass access controls to view or modify resources they should not have permission to access. The vulnerability has been patched in version 5.6.0.
Affected products
- Magepeople WpEvently <=5.5.0
Timeline
- 2026-08-27: disclosed: Vulnerability published by Patchstack
- 2026-08-27: patched: Fix available in version 5.6.0