EventPrime CVE-2026-118523

Exploitation requires only that the target site runs EventPrime before 4.3.6.1 and has content in the built-in WordPress 'Pending Review' post status; the vulnerability is that the plugin fails to keep that status non-public. No authentication, special privileges, or user interaction is needed (AV:N/AC:L/PR:N/UI:N), so it works against default configurations. The practical limits are: there must actually be pending-review posts, pages, or other content to disclose; impact is confined to reading that content (no write or availability effect); and the exposure window ends once content is published or deleted. The listed PoC is not verified as working exploit code, so real-world ease of exploitation is not independently confirmed.

This is a genuine but modest-severity information-disclosure issue rather than a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no authentication and no user interaction, but impact is limited to confidentiality (C:L, I:N, A:N) - an attacker can read content that was meant to stay private (Pending Review posts/pages), not modify or disrupt anything. The supporting signals reinforce a low real-world urgency: EPSS is only 0.15% (4th percentile), the CVE is NOT in CISA KEV, and the SSVC framework records Exploitation=none. SSVC does flag Automatable=yes and Technical Impact=partial, which is consistent with the low-complexity unauthenticated vector - the disclosure could be scripted at scale - but with no observed exploitation and a low EPSS, the automatability raises attention without indicating an active campaign. The vuln.today decision label is 'this_month', matching a fix-on-normal-cadence posture rather than an emergency. One consistency note: the input lists a PoC reference but marks it 'not verified as working exploit code', so the practical barrier to exploitation is unconfirmed. Overall, all severity and exploitation signals agree that this is a low-to-moderate priority confidentiality bug, not a high-urgency threat.

An unauthenticated attacker requests or enumerates URLs of posts and pages on a site running the vulnerable EventPrime plugin and retrieves content that is still in the built-in Pending Review status, which should not be publicly visible. This exposes unpublished or under-review content such as draft event details or editorial material ahead of its intended release. A public PoC reference exists but is not verified as working exploit code.