CVE-2026-62041: Missing Authorization in Ashok Dudhat WP Event Manager

The WP Event Manager plugin for WordPress, developed by Ashok Dudhat, contains a missing authorization vulnerability identified as CVE-2026-62041. This issue arises from incorrectly configured access control security levels, which could allow an attacker with limited privileges to perform unauthorized actions. The vulnerability affects all versions from the initial release through 3.4.1 inclusive. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity with no impact on availability.

An attacker with low privileges can exploit this vulnerability to bypass access controls and perform unauthorized actions within the WP Event Manager plugin. The impact is limited to low confidentiality and integrity loss without affecting availability. There are no known exploits in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user privileges and monitor plugin usage carefully to limit potential exploitation.