Vulnerability feed

Executive summary

A missing authorization flaw in the WpEvently WordPress plugin, made by Magepeople inc, lets users reach functions they should not be able to use. The advisory rates it CVSS 6.5 but says it is low priority and unlikely to be exploited. The vendor recommends updating the plugin to version 5.7.9 or later.

Technical summary

The weakness is classed as Broken Access Control (OWASP A1) in WpEvently plugin versions up to and including 5.7.8. The required privilege is listed as Unauthenticated, and the advisory does not describe the specific attack steps or endpoints. The patched version is 5.7.9, and the advisory recommends updating to that version or later, with hosting providers or developers as a fallback if updating is not possible. No workarounds are stated beyond updating, and no detection guidance, indicators of compromise, or evidence of exploitation in the wild is stated. The advisory gives CVSS 6.5 but does not provide a full CVSS vector string.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affects

Magepeople inc.Magepeople inc. WpEvently