Description
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.
Published:
2026-11-05
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Community Events | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Thu, 05 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site. | |
| Title | Community Events < 1.6.0 - Unauthenticated Pending Events Disclosure via ajax_admin_event_list | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-05T06:00:24.863Z
Reserved: 2026-09-08T12:06:21.843Z
Link: CVE-2026-86795
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-05T06:17:09.193
Modified: 2026-11-05T06:17:09.193
Link: CVE-2026-86795
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.