Description

Contributor Broken Access Control in WpEvently <= 5.5.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-28T16:18:30.210Z",
  "pubdate": "2026-08-28T16:18:30.210Z",
  "executiveSummary": "WpEvently versions 5.5.0 and earlier contain a critical broken access control vulnerability.\nThis vulnerability allows authenticated users with low-level privileges, specifically the Contributor role, to perform unauthorized actions restricted to higher-level users.\nThe flaw stems from insufficient server-side authorization checks within the plugin's core functionality, enabling unauthorized modification or execution of administrative processes.\nSuccessful exploitation results in significant security compromises, including unauthorized configuration changes, data manipulation, or potentially broader system impact, depending on the specific administrative functions accessible via the flawed endpoints.\nThe vulnerability requires an authenticated session with a Contributor-level account to initiate the exploitation vector, meaning it is not directly exploitable by unauthenticated remote attackers without first compromising such an account.\nThe risk implication is high, as it bypasses the principle of least privilege within the WordPress environment, allowing for vertical privilege escalation and unauthorized administrative operations.",
  "technicalDetails": "The vulnerability exists within the WpEvently plugin, affecting versions 5.5.0 and below. The root cause is a failure to properly implement authorization checks (capability validation) on sensitive administrative functions or endpoints intended only for users with higher-level privileges, such as Administrators or Editors.\nIn WordPress plugin development, developers must use the current_user_can() function to verify if the requesting user possesses the necessary capabilities before executing privileged code. The vulnerability suggests that WpEvently fails to apply these checks, or applies insufficient checks, to functions reachable by users mapped to the Contributor role.\nThe attack flow proceeds as follows: An attacker authenticates to the WordPress site as a user with a 'Contributor' role. The attacker then identifies requests made by the plugin to perform administrative tasks, such as saving settings, deleting events, or modifying plugin configurations. Because the plugin lacks proper authorization validation, these requests are successfully processed by the server when initiated by the Contributor account.\nBy crafting malicious requests to the vulnerable endpoints, the Contributor user can invoke server-side logic that should be gated. This represents a breakdown in the access control mechanism, where the server-side code trusts the request without verifying the permission context of the initiator.\nThe impact of this broken access control is significant. Depending on the exposed functionality, a Contributor could modify plugin settings, alter event data, or trigger other administrative workflows. If the plugin uses these endpoints for database operations, it could lead to unauthorized data modification. Furthermore, if these endpoints are not protected by proper nonces or if they fail to validate the user's capabilities against the required capability for that action, it may lead to further exploitation paths. The vulnerability is entirely server-side, requiring the attacker to interact directly with the plugin's backend endpoints while authenticated as a Contributor."
}