---
id: CVE-2026-86795
title: >-
  Community Events < 1.6.0 - Unauthenticated Pending Events Disclosure via
  ajax_admin_event_list
summary: >-
  The Community Events WordPress plugin before 1.6.0 does not have authorisation
  or nonce checks in one of its AJAX actions, allowing unauthenticated users to
  retrieve details of event submissions awaiting moderation, which are not
  availab…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: Community Events
affected:
  - community_events < 1.6.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T11:51:40.146553Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:04:35.875Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86795'
references:
  - url: 'https://wpscan.com/vulnerability/ab9ca7bc-e5a0-4a7b-b60b-4c3740c07214/'
tags:
  - cve.org
epss: 0.00137
epssPercentile: 0.03118
ingestedAt: '2026-11-05T21:36:00.780Z'
---

## Overview

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.

## Affected

- `community_events < 1.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.