What is the CVSS score of CVE-2026-24378?

CVE-2026-24378 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Eventprime are affected by CVE-2026-24378?

CVE-2026-24378 presents critical security risk, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2026-24378?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Eventprime CVE-2026-24378

EUVD-2026-15573 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-544w-wmqh-vq4j

Deserialization Eventprime

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15573

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.

AnalysisAI

This is a PHP Object Injection vulnerability in the Metagauss EventPrime WordPress plugin (eventprime-event-calendar-management) caused by unsafe deserialization of untrusted data. All versions up to and including 4.2.8.0 are affected, allowing attackers to inject malicious serialized objects that can lead to remote code execution or arbitrary actions depending on available PHP gadget chains. The vulnerability has been publicly disclosed and documented by Patchstack; exploitation likelihood and real-world impact depend on the presence of exploitable gadget chains in the target WordPress environment.

Technical ContextAI

The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a critical class of flaws in PHP applications that process serialized objects without validation. PHP's unserialize() function, when applied to attacker-controlled input, can instantiate arbitrary classes and trigger magic methods (__wakeup, __destruct, __toString, etc.), enabling Object Injection attacks. The EventPrime plugin (identified via CPE cpe:2.3:a:metagauss:eventprime:*:*:*:*:*:*:*:*) likely accepts serialized data from HTTP requests, database entries, or transients without proper sanitization. In WordPress environments, this is particularly dangerous because the WordPress ecosystem contains numerous publicly documented gadget chains in popular plugins and themes that can chain multiple objects together to achieve Remote Code Execution (RCE). The flaw affects the core event calendar management functionality of the plugin, suggesting the injection point may be in event data processing, plugin options, or user input handling.

RemediationAI

Immediately update the EventPrime plugin to a version higher than 4.2.8.0 if a patched version is available (check the official WordPress plugin repository or Metagauss documentation). If no patched version is available, consider temporarily deactivating the EventPrime plugin until an update is released, as this is a critical code execution vulnerability. As interim mitigations while awaiting a patch, implement Web Application Firewall (WAF) rules to block requests containing suspicious serialized PHP objects (looking for patterns like 'O:' or 'C:' which indicate object instantiation), restrict plugin access to authenticated users only if possible, and audit WordPress transients and options for any suspicious serialized data. Additionally, review server-side access logs for any evidence of attempted exploitation. Once the plugin is updated, clear all WordPress caches and verify that no malicious code has been injected into the site through a comprehensive security scan or manual code review of the wp-content directory.