CVE-2026-86795

{
  "etk_id": "ETK-2026-3607",
  "cve_id": "CVE-2026-86795",
  "display_id": "CVE-2026-86795",
  "ghsa_id": "GHSA-c425-pjx7-2qq4",
  "euvd_id": "EUVD-2026-117340",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authorization in Community Events AJAX action",
  "summary": "Community Events for WordPress versions before 1.6.0 expose an AJAX action without adequate authorization controls. An unauthenticated remote party can retrieve details from event submissions awaiting moderation when the vulnerable plugin is installed and reachable.",
  "mitigation": "Update Community Events to version 1.6.0 or later. Restrict public access to the affected WordPress site until the update is applied if immediate patching is not possible.",
  "vendor": null,
  "product": "Community Events",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.6.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.6.0"
      ],
      "package_name": "Community Events",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.01411835,
  "t0_at": "2026-11-05T06:00:24.863000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-05T09:14:46.114219+00:00",
      "days": 0.1349681854050926,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T06:00:24.863000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-05T06:00:24.863000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T06:00:24.863000+00:00",
      "url": "https://github.com/advisories/GHSA-c425-pjx7-2qq4"
    }
  }
}