What is the CVSS score of CVE-2026-25312?

CVE-2026-25312 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Eventprime are affected by CVE-2026-25312?

The EventPrime WordPress plugin contains a critical payment authorization flaw that could allow attackers to bypass payment requirements and access paid content without completing transactions.

How to fix or mitigate CVE-2026-25312?

Within 24 hours: Identify all WordPress installations running EventPrime plugin versions 4.2.8.3 or earlier and assess exposure; disable the plugin if not business-critical. Within 7 days: Contact EventPrime support for patch timeline; implement WAF rules to monitor and block suspicious payment API requests; conduct audit of recent transactions for anomalies. Within 30 days: Upgrade to patched version when available; review payment logs for unauthorized access; implement additional API authentication controls.

Eventprime CVE-2026-25312

EUVD-2026-13061 HIGH

Missing Authorization (CWE-862)

2026-03-19 Patchstack

Authentication Bypass Eventprime

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 10:22 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 07:30 euvd

EUVD-2026-13061

Analysis Generated

Mar 19, 2026 - 07:30 vuln.today

CVE Published

Mar 19, 2026 - 07:20 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 4.2.8.3.

AnalysisAI

EventPrime versions through 4.2.8.3 contain an authorization bypass vulnerability that allows unauthenticated remote attackers to modify data through improperly configured access controls. The flaw enables integrity compromise without requiring authentication or user interaction, affecting all installations of the affected versions. No patch is currently available.

Technical ContextAI

This vulnerability affects EventPrime (CPE: cpe:2.3:a:eventprime:eventprime), a WordPress event calendar and management plugin. The root cause is classified as CWE-862 (Missing Authorization), which occurs when the software does not perform an authorization check when an actor attempts to access a resource or perform an action. In this case, the plugin fails to properly validate user permissions before allowing modifications to payment-related functionality, enabling attackers to manipulate payment flows without proper authentication. This represents a fundamental failure in implementing access control mechanisms at critical security boundaries within the WordPress plugin architecture.

RemediationAI

Upgrade EventPrime to a version newer than 4.2.8.3 that addresses this missing authorization vulnerability. Consult the Patchstack vulnerability report at https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-2-8-3-payment-bypass-vulnerability?_s_id=cve for specific patched version information and vendor guidance. Until patching is completed, consider temporarily disabling the EventPrime plugin if payment processing is not immediately critical, or implement web application firewall (WAF) rules to restrict access to payment-related endpoints to authenticated and authorized users only. Review server logs for any suspicious payment modification attempts targeting EventPrime functionality and validate the integrity of all existing payment records.