{"id":"CVE-2026-114192","kind":"vulnerability","aliases":["CVE-2026-114192"],"related":[],"title":"WpEvently WordPress plugin: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.","summary":"WpEvently (mage-eventpress), a WordPress event plugin by Magepeople, has a missing authorization check, so requests can reach functions that should be restricted. The sources say an attacker can exploit incorrectly configured access control, affecting versions through 5.7.8.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-booking","runtime","wordpress","wp-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WpEvently plugin version in the WordPress admin under Plugins, or with `wp plugin get mage-eventpress --field=version`\n- unknown whether the sources give a specific endpoint or setting to inspect","fix":"- Update WpEvently (mage-eventpress) to a version later than `5.7.8`, if the vendor has released one; the sources do not name a fixed version\n- unknown whether a configuration change mitigates it","status":"open","published_at":"2026-10-24T14:16:39+00:00","first_seen_at":"2026-10-24T14:48:21+00:00","triaged_at":"2026-10-25T03:47:04+00:00","updated_at":"2026-10-25T03:47:04+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T03:47:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update WpEvently (mage-eventpress) to a version later than `5.7.8`, if the vendor has released one; the sources do not name a fixed version\n- unknown whether a configuration change mitigates it","reach":"internet","title":"WpEvently WordPress plugin: missing authorization lets users bypass access controls","impact":"medium","summary":"WpEvently (mage-eventpress), a WordPress event plugin by Magepeople, has a missing authorization check, so requests can reach functions that should be restricted. The sources say an attacker can exploit incorrectly configured access control, affecting versions through 5.7.8.","category":"runtime","nicknames":[],"who_cares":["wordpress","wp-plugin","event-booking"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown access to restricted plugin functions on the site","analyst_note":"Sources give only the NVD entry and a generic description; find the vendor advisory or changelog to identify the affected endpoint, required privilege, and fixed version.","how_to_check":"- Check the installed WpEvently plugin version in the WordPress admin under Plugins, or with `wp plugin get mage-eventpress --field=version`\n- unknown whether the sources give a specific endpoint or setting to inspect","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WpEvently (mage-eventpress) version 5.7.8 or earlier are in the affected range according to the sources. The sources do not describe which data paths or roles are exposed, so unknown beyond the plugin version.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3282,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114192':13A,16A '-2026':12A,15A '5.7.8':63B,88C 'access':9A,58B,78C 'affect':60B,83C 'allow':74C 'attack':53B 'author':5A,38B,65C 'book':19B 'bypass':8A 'check':39B 'configur':57B,77C 'control':10A,59B,79C 'cve':11A,14A 'event':18B,31B 'event-book':17B 'eventpress':28B,73C 'exploit':55B,75C 'function':44B 'inc':69C 'incorrect':56B,76C 'issu':82C 'let':6A 'levels.this':81C 'mage':27B,72C 'mage-eventpress':26B,71C 'magepeopl':34B,68C 'miss':4A,37B,64C 'n/a':86C 'plugin':3A,24B,32B 'reach':43B 'request':41B 'restrict':48B 'runtim':20B 'say':51B 'secur':80C 'sourc':50B 'user':7A 'version':61B 'vulner':66C 'wordpress':2A,21B,30B 'wp':23B 'wp-plugin':22B 'wpevent':1A,25B,70C,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running WpEvently (mage-eventpress) version 5.7.8 or earlier are in the affected range according to the sources. The sources do not describe which data paths or roles are exposed, so unknown beyond the plugin version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T14:16:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114192","severity":null,"published_at":"2026-10-24T14:16:39+00:00","modified_at":"2026-10-24T14:16:39+00:00","first_seen_at":"2026-10-24T14:48:21+00:00","fetched_at":"2026-10-24T14:48:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}