Missing Authorization in Display Eventbrite Events Widget by fullworks
CVE-2026-39535

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Display Eventbrite Events
Vendor
CVE Published:
8 April 2026

What is CVE-2026-39535?

A critical vulnerability in the Display Eventbrite Events widget by fullworks allows attackers to exploit incorrectly configured access control security levels. This issue affects the plugin in various configurations, potentially leading to unauthorized access to sensitive data and actions. Users are urged to verify their installation against the affected versions and apply necessary updates to mitigate risks.

Affected Version(s)

Display Eventbrite Events 0 <= 6.5.6

References

https://patchstack.com/database/Wordpress/Plugin/widget-f...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bao - BlueRock | Patchstack Bug Bounty Program
.