This vulnerability (CVE-2026-81802) in WpEvently versions up to 5.6.0 is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). It involves unauthenticated Insecure Direct Object References (IDOR), allowing attackers to bypass authorization mechanisms by manipulating user-controlled keys. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts are low and high respectively. No known exploits are reported in the wild, and no vendor remediation or patch is currently documented.

An attacker can exploit this vulnerability without authentication to bypass authorization controls, potentially causing unauthorized integrity and availability impacts on the affected system. Confidentiality is not impacted. The vulnerability could allow unauthorized modification or disruption of data or services within WpEvently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.