# CVE-2026-81759: WpEvently broken access control in contributor role

Source: https://junglewise.ai/threats/cve-2026-81759-wpevently-broken-access-control-in-contributor-role  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81759 · Severity: medium · CVSS 5.4 · Published 2026-08-28

WpEvently is a WordPress plugin for managing events, tickets, and bookings. A broken access control vulnerability allows users with contributor privileges to access or perform actions they should not be authorized to perform, potentially exposing event data or modifying event settings inappropriately.

Technologies: [MagePeople WpEvently](https://junglewise.ai/threats/technologies/wpevently). Vendors: [MagePeople](https://junglewise.ai/threats/vendors/magepeople).

## Quick answers

**Is CVE-2026-81759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81759 being exploited in the wild.

**How severe is CVE-2026-81759?** Medium severity, with a CVSS score of 5.4, published 28 August 2026.

**Which products and versions are affected?** MagePeople WpEvently <=5.5.0.

**Is there a fix for CVE-2026-81759?** A patch was published on 2026-08-27: Fix available in version 5.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81759 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81759?** Check whether you run MagePeople WpEvently at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a broken access control vulnerability (OWASP A1) in WpEvently versions up to 5.5.0 where insufficient authorization checks allow authenticated users with contributor role to access sensitive functionality or data. The vulnerability is triggered by an authenticated attacker with contributor-level privileges on the WordPress site. The attack requires no network access beyond normal WordPress authentication and no user interaction from administrators. An attacker can bypass access controls to view or modify resources they should not have permission to access. The vulnerability has been patched in version 5.6.0.

## Affected products

- Magepeople WpEvently <=5.5.0

## Timeline

- 2026-08-27: disclosed: Vulnerability published by Patchstack
- 2026-08-27: patched: Fix available in version 5.6.0

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-5-0-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-5-0-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Magepeople WpEvently cross-site scripting in event content](https://junglewise.ai/threats/cve-2026-116394-improper-neutralization-of-script-related-html-tags-in-a-web)
- [WpEvently Insecure Direct Object References (IDOR)](https://junglewise.ai/threats/cve-2026-81802-wpevently-insecure-direct-object-references-idor)
- [WpEvently broken access control for subscribers](https://junglewise.ai/threats/cve-2026-81761-wpevently-broken-access-control-for-subscribers)
- [Magepeople WpEvently CSRF in WordPress plugin](https://junglewise.ai/threats/cve-2024-32110-magepeople-wpevently-csrf-in-wordpress-plugin)