What is the CVSS score of CVE-2026-39518?

CVE-2026-39518 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of EventPrime are affected by CVE-2026-39518?

EventPrime WordPress plugin (versions up to 4.3.0.0) contains an access control flaw allowing basic subscriber accounts to view and modify event records belonging to other users, creating significant…

How to fix or mitigate CVE-2026-39518?

Within 24 hours: Identify all WordPress installations running EventPrime and confirm current plugin versions; assess whether open subscriber registration is enabled and estimate the volume and sensitivity of event records exposed to unauthorized access. Within 7 days: Restrict Subscriber role capabilities to prevent access to event records; implement role-based access controls enforcing that users can only view/modify their own event records; enable detailed audit logging of all event record access and modifications. Within 30 days: Monitor vendor and Patchstack advisory channels for patch availability; upon patch release, plan and execute urgent deployment to all affected installations; review access logs for signs of unauthorized event record access.

EventPrime CVE-2026-39518

EUVD-2026-36955 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-15 Patchstack

GHSA-fgrh-26m2-w86v

Authentication Bypass Eventprime

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-reachable WordPress endpoint, no user interaction, requires a Subscriber account (PR:L); IDOR exposes others' records (C:H) with limited write/tamper (I:L) and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:21 vuln.today

DescriptionCVE.org

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

AnalysisAI

Insecure direct object reference in the EventPrime WordPress plugin (versions up to and including 4.3.0.0) allows authenticated users holding only the low-privilege Subscriber role to access or manipulate event records belonging to other users by tampering with object identifiers. The flaw was disclosed by Patchstack and carries CVSS 7.1 reflecting high confidentiality impact with limited integrity impact, but no public exploit identified at time of analysis and no CISA KEV listing. Because WordPress sites frequently allow open subscriber registration, the low PR:L barrier is practically trivial to clear on affected installations.

Technical ContextAI

EventPrime is a WordPress plugin for event calendar and booking management (CPE cpe:2.3:a:eventprime:eventprime). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): one or more plugin endpoints reachable by authenticated Subscribers accept an object identifier (such as an event, booking, or attendee ID) as a request parameter and act on the referenced record without verifying that the calling user owns or is otherwise authorized for that object. This is a classic missing-authorization pattern in WordPress plugins where capability and ownership checks are not enforced inside AJAX actions or REST routes before the object lookup.

RemediationAI

Upstream fix available per Patchstack advisory; a released patched version is not independently confirmed in the provided data, so administrators should update EventPrime to the latest release above 4.3.0.0 published on the WordPress.org plugin repository and verify the changelog references this IDOR fix (Patchstack advisory: https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-0-0-insecure-direct-object-references-idor-vulnerability). Until the update is applied, compensating controls include disabling open user registration in WordPress general settings (Settings → General → Membership) to remove the trivial path to a Subscriber account, with the trade-off that legitimate self-service event signup will require an alternate workflow; restricting access to the plugin's AJAX and REST endpoints (admin-ajax.php actions and any /wp-json/eventprime/* routes) via WAF or web server ACLs to authenticated session cookies you trust; and auditing existing low-privilege accounts for unexpected registrations. If the plugin is non-essential, deactivating and removing it is the cleanest mitigation.