What is the CVSS score of CVE-2026-42669?

CVE-2026-42669 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of EventPrime are affected by CVE-2026-42669?

EventPrime WordPress plugin (versions ≤4.3.2.0) contains a broken access control vulnerability (CVE-2026-42669) that allows unauthenticated attackers to modify customer event data and bookings.

How to fix or mitigate CVE-2026-42669?

Within 24 hours: Audit all WordPress installations running EventPrime versions 4.3.2.0 or earlier and document deployment scope and operational criticality. Within 7 days: Disable and remove the plugin from all production instances; if operationally infeasible, implement WAF rules blocking unauthenticated requests to EventPrime plugin endpoints and apply database-level write restrictions. Within 30 days: Evaluate alternative WordPress event management plugins; monitor Patchstack and vendor advisories for security patches and plan controlled testing upon release.

EventPrime CVE-2026-42669

EUVD-2026-33907 HIGH

Missing Authorization (CWE-862)

2026-06-02 Patchstack

GHSA-9j3v-mc2g-8jc6

Authentication Bypass Eventprime

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 11:51 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects EventPrime: from n/a through 4.3.2.0.

AnalysisAI

Broken access control in the EventPrime WordPress plugin (versions up to and including 4.3.2.0) allows unauthenticated remote attackers to modify or tamper with data due to incorrectly configured access control security levels. The flaw, reported by Patchstack and tracked as CWE-862 (Missing Authorization), carries a CVSS 3.1 base score of 7.5 with an integrity-only impact; no public exploit identified at time of analysis.

Technical ContextAI

EventPrime is an event calendar management plugin for WordPress (CPE: cpe:2.3:a:eventprime:eventprime:*:*:*:*:*:*:*:*) widely used to publish, manage, and book events on WordPress sites. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints - typically AJAX actions or REST routes registered via WordPress hooks - fail to invoke a capability check (such as current_user_can()) or nonce verification before performing a privileged action. Because WordPress plugins commonly expose admin-ajax.php and REST API handlers to any HTTP client, missing authorization checks at the handler level expose those actions directly to unauthenticated visitors. Patchstack, which curates the WordPress vulnerability database referenced here, classifies this as a broken access control issue affecting the plugin through 4.3.2.0.

RemediationAI

Upgrade the EventPrime plugin to a version newer than 4.3.2.0 once the vendor publishes a fix - no vendor-released patched version is identified in the supplied data, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-2-0-broken-access-control-vulnerability) and the plugin's WordPress.org listing for an update notification. In the interim, compensating controls include deactivating the EventPrime plugin entirely (trade-off: event calendar and booking functionality is lost), restricting access to /wp-admin/admin-ajax.php and the WordPress REST API namespace used by EventPrime via a WAF or web server rules to authenticated sessions only (trade-off: may break legitimate front-end booking flows that rely on unauthenticated AJAX), and enabling a virtual patching solution such as Patchstack or Wordfence which typically ships rules for newly disclosed plugin vulnerabilities. Audit existing event, booking, and configuration records for unexpected modifications introduced before mitigation.