What is the CVSS score of CVE-2026-56053?

CVE-2026-56053 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of EventPrime are affected by CVE-2026-56053?

EventPrime WordPress plugin (versions ≤4.3.4.1) contains an object injection vulnerability enabling authenticated Subscriber users to manipulate data or potentially execute code, with no public…

How to fix or mitigate CVE-2026-56053?

24 hours: Identify all WordPress instances running EventPrime ≤4.3.4.1; audit all Subscriber account access and privileges; prepare incident response procedures. 7 days: Restrict or disable new Subscriber account creation; disable EventPrime plugin if not business-critical; implement monitoring on EventPrime-related activity. 30 days: Monitor Patchstack and vendor channels for patch availability; evaluate alternative event management plugins; plan plugin removal if patch remains unavailable.

EventPrime CVE-2026-56053

EUVD-2026-39382 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-25 Patchstack

GHSA-h5wm-8hx6-m9ff

Deserialization PHP Eventprime WordPress Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable with low complexity and no interaction; requires a Subscriber account (PR:L); object injection can yield full C/I/A impact via gadget chains, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:23 vuln.today

DescriptionCVE.org

Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

Articles & Coverage 1

News 3 New PHP Vulnerabilities - 3 High Severity, 1 With POC Jun 26, 2026

AnalysisAI

PHP Object Injection in the EventPrime event-calendar-management WordPress plugin (versions 4.3.4.1 and earlier) allows an authenticated attacker holding only a low-privilege Subscriber account to inject crafted serialized objects into an unsafe deserialization sink. Depending on the PHP gadget chains present in WordPress core, the plugin, or other installed plugins, this can escalate to data tampering, information disclosure, or remote code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Patchstack.

Technical ContextAI

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). EventPrime is a PHP-based WordPress plugin for event and calendar management. The flaw arises when attacker-controllable input reaches a PHP unserialize()-style operation without validation, letting an attacker instantiate arbitrary PHP objects. PHP Object Injection is rarely directly exploitable on its own - its real impact depends on the availability of 'POP gadget' chains (classes with exploitable __wakeup(), __destruct(), or other magic methods) loaded in the WordPress runtime, which is why such bugs are often chained with code in core or third-party plugins to reach file write, SQL, or code execution. The single CPE provided (cpe:2.3:a:eventprime:eventprime:*) confirms the affected component is the EventPrime application itself across all versions up to and including 4.3.4.1.

RemediationAI

Upgrade EventPrime to the latest available release above 4.3.4.1; the input data does not specify the exact patched version, so confirm the fixed build directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-4-1-php-object-injection-vulnerability) and the plugin's WordPress.org changelog before deploying. Until patched, reduce the attack surface by disabling open user self-registration (Settings > General > 'Anyone can register') so attackers cannot trivially obtain the Subscriber account the exploit requires - trade-off: this blocks legitimate public sign-ups. Additionally, restrict or audit existing low-privilege accounts, and deploy a WordPress WAF (such as Patchstack's own virtual patching) to filter serialized-object payloads to plugin endpoints - trade-off: WAF rules may need tuning to avoid false positives. No vendor-released patch version is independently confirmed from the available data, so treat virtual patching as interim, not a substitute for upgrading.