What is the CVSS score of CVE-2026-42687?

CVE-2026-42687 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of EventPrime WordPress Plugin are affected by CVE-2026-42687?

The EventPrime event calendar plugin for WordPress (versions ≤4.3.2.1) contains an unauthenticated object injection vulnerability permitting remote code execution on affected servers without…

How to fix or mitigate CVE-2026-42687?

WITHIN 24 HOURS: Inventory all WordPress installations for EventPrime versions ≤4.3.2.1 using wp-cli 'wp plugin list' or WordPress Admin > Plugins page; document affected systems and priorities. WITHIN 7 DAYS: Immediately deactivate the plugin via WordPress Admin panel and rename plugin directory (/wp-content/plugins/eventprime/) to prevent reactivation; monitor Patchstack and EventPrime vendor advisories for patched version release. WITHIN 30 DAYS: Evaluate alternative calendar solutions (Modern Events Calendar, Eventify, or The Events Calendar) or validate and deploy patched EventPrime version after staging environment testing.

EventPrime WordPress Plugin CVE-2026-42687

EUVD-2026-36835 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-cr5x-4xrc-3jfr

PHP Deserialization Eventprime

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Pre-auth network-reachable WordPress plugin endpoint (AV:N/PR:N/UI:N); AC:H because PHP object injection requires a usable gadget chain; full CIA impact via deserialization-driven code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:56 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the EventPrime event calendar plugin for WordPress (versions <= 4.3.2.1) allows remote attackers to inject crafted serialized PHP objects that may trigger arbitrary deserialization-driven gadget chains, leading to potential remote code execution, file manipulation, or data tampering. The flaw is reachable without authentication but carries CVSS:3.1 AC:H, indicating non-trivial preconditions for successful exploitation. No public exploit identified at time of analysis, but Patchstack disclosure typically precedes broader exploit development against the WordPress plugin ecosystem.

Technical ContextAI

EventPrime is a WordPress plugin (CPE cpe:2.3:a:eventprime:eventprime) providing event calendar and booking functionality on PHP-based WordPress sites. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) - the plugin passes attacker-controllable input to PHP's unserialize() (or an equivalent magic-method invocation path) without sufficient validation. When combined with a POP (Property-Oriented Programming) gadget chain present in WordPress core, common libraries, or other installed plugins, deserialization of an attacker-supplied object can invoke __wakeup, __destruct, or other magic methods that perform sensitive operations such as file writes, SQL execution, or arbitrary code execution within the WordPress process context.

RemediationAI

Upstream fix available per Patchstack advisory; a patched version higher than 4.3.2.1 is implied but not independently confirmed from the provided data - administrators should consult the Patchstack entry (https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-2-1-php-object-injection-vulnerability) and the WordPress.org changelog for eventprime-event-calendar-management to confirm the exact fixed release and update immediately. If patching is delayed, deactivate the EventPrime plugin entirely (this disables all event/calendar/booking functionality on the site) as the most reliable compensating control, or restrict access to EventPrime's front-end and AJAX endpoints via a WAF rule blocking serialized PHP payloads (strings containing patterns like O:<digit>:"<classname>":, a:<digit>:{, or s:<digit>: in request bodies and query parameters) - note that broad WAF rules of this shape can produce false positives on legitimate base64 content and should be tuned. Audit web server and PHP error logs for unserialize() warnings referencing EventPrime code paths to detect attempted exploitation.