---
id: "CVE-2026-86795"
kind: "vulnerability"
aliases: ["CVE-2026-86795"]
title: "Community Events WordPress plugin: unauthenticated users can read pending event submissions"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["community-events", "package", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-1.6.0-or-later"]
published_at: "2026-11-05T06:17:09+00:00"
first_seen_at: "2026-11-05T06:31:52+00:00"
updated_at: "2026-11-05T06:33:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86795", "first_seen_at": "2026-11-05T06:31:52+00:00"}]
exploit_sources: []
---

# Community Events WordPress plugin: unauthenticated users can read pending event submissions

The Community Events WordPress plugin before 1.6.0 has an AJAX action with no authorisation or nonce checks. Anyone on the internet can retrieve details of event submissions waiting for moderation, which are not shown on the public site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Community Events plugin version in the WordPress admin under Plugins; a version below `1.6.0` is affected.

## Fix

- Update the Community Events plugin to `1.6.0` or later.

## Timeline

- 2026-11-05T06:31:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86795

## From the sources

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_