# CVE-2026-81761: WpEvently broken access control for subscribers

Source: https://junglewise.ai/threats/cve-2026-81761-wpevently-broken-access-control-for-subscribers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81761 · Severity: medium · CVSS 4.3 · Published 2026-08-28

WpEvently is a WordPress plugin for managing events and bookings. A broken access control vulnerability allows subscribers (lower-privileged user accounts) to view or access content they should not have permission to see, such as other users' data or restricted pages. This could result in unauthorized exposure of sensitive event or customer information on WordPress sites using the plugin.

Technologies: [MagePeople WpEvently](https://junglewise.ai/threats/technologies/wpevently). Vendors: [MagePeople](https://junglewise.ai/threats/vendors/magepeople).

## Quick answers

**Is CVE-2026-81761 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81761 being exploited in the wild.

**How severe is CVE-2026-81761?** Medium severity, with a CVSS score of 4.3, published 28 August 2026.

**Which products and versions are affected?** MagePeople WpEvently <=5.5.0.

**Is there a fix for CVE-2026-81761?** A patch was published on 2026-08-27: Version 5.6.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81761 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-81761?** Check whether you run MagePeople WpEvently at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control flaw in WpEvently versions up to and including 5.5.0. An attacker with subscriber-level privileges can bypass authorization checks to access or perform actions restricted to higher-privilege roles, potentially viewing data belonging to other users. The vulnerability is network-accessible and requires only subscriber-level authentication. A patch is available in version 5.6.0 and later.

## Affected products

- Magepeople WpEvently <=5.5.0

## Timeline

- 2026-08-27: disclosed
- 2026-08-27: patched: Version 5.6.0 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-5-0-broken-access-control-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-5-0-broken-access-control-vulnerability-2?_s_id=cve)

## Related threats

- [Magepeople WpEvently cross-site scripting in event content](https://junglewise.ai/threats/cve-2026-116394-improper-neutralization-of-script-related-html-tags-in-a-web)
- [WpEvently Insecure Direct Object References (IDOR)](https://junglewise.ai/threats/cve-2026-81802-wpevently-insecure-direct-object-references-idor)
- [WpEvently broken access control in contributor role](https://junglewise.ai/threats/cve-2026-81759-wpevently-broken-access-control-in-contributor-role)
- [Magepeople WpEvently CSRF in WordPress plugin](https://junglewise.ai/threats/cve-2024-32110-magepeople-wpevently-csrf-in-wordpress-plugin)