{"id":"CVE-2026-86795","kind":"vulnerability","aliases":["CVE-2026-86795"],"related":[],"title":"Community Events WordPress plugin: unauthenticated users can read pending event submissions","description":"The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.","summary":"The Community Events WordPress plugin before 1.6.0 has an AJAX action with no authorisation or nonce checks. Anyone on the internet can retrieve details of event submissions waiting for moderation, which are not shown on the public site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["community-events","package","wordpress"],"not_affected_if":["plugin-not-installed","version-1.6.0-or-later"],"how_to_check":"- Check the installed Community Events plugin version in the WordPress admin under Plugins; a version below `1.6.0` is affected.","fix":"- Update the Community Events plugin to `1.6.0` or later.","status":"open","published_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","triaged_at":"2026-11-05T06:33:04+00:00","updated_at":"2026-11-05T06:33:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T06:33:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Community Events plugin to `1.6.0` or later.","reach":"internet","title":"Community Events WordPress plugin: unauthenticated users can read pending event submissions","impact":"low","summary":"The Community Events WordPress plugin before 1.6.0 has an AJAX action with no authorisation or nonce checks. Anyone on the internet can retrieve details of event submissions waiting for moderation, which are not shown on the public site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","community-events"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated visitors read private pending event submissions","analyst_note":"","how_to_check":"- Check the installed Community Events plugin version in the WordPress admin under Plugins; a version below `1.6.0` is affected.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.6.0-or-later"],"who_is_affected":"Sites running the Community Events WordPress plugin before 1.6.0 that accept event submissions and hold submissions awaiting moderation. The exposure is the unauthenticated AJAX action, so any site with the plugin installed and active is in scope. Sites without the plugin, or already on 1.6.0 or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000675,"input_tokens":4208,"output_tokens":508,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86795':14A,17A '1.6.0':29B,67C 'action':33B,80C 'ajax':32B,79C 'allow':81C 'anyon':40B 'anywher':96C 'authoris':36B,71C 'avail':95C 'await':90C 'check':39B,74C 'communiti':1A,19B,24B,62C 'community-ev':18B 'cve':12A,15A 'detail':46B,86C 'event':2A,10A,20B,25B,48B,63C,88C 'internet':43B 'moder':52B,91C 'nonc':38B,73C 'one':76C 'packag':21B 'pend':9A 'plugin':4A,27B,65C 'public':59B,99C 'read':8A 'retriev':45B,85C 'shown':56B 'site':60B,100C 'submiss':11A,49B,89C 'unauthent':5A,82C 'user':6A,83C 'wait':50B 'wordpress':3A,22B,26B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Community Events WordPress plugin before 1.6.0 that accept event submissions and hold submissions awaiting moderation. The exposure is the unauthenticated AJAX action, so any site with the plugin installed and active is in scope. Sites without the plugin, or already on 1.6.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["communityevents","medium","package","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86795","severity":null,"published_at":"2026-11-05T06:17:09+00:00","modified_at":"2026-11-05T06:17:09+00:00","first_seen_at":"2026-11-05T06:31:52+00:00","fetched_at":"2026-11-05T06:31:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}