EUVD-2026-33907
GHSA-9j3v-mc2g-8jc6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects EventPrime: from n/a through 4.3.2.0.
AnalysisAI
Broken access control in the EventPrime WordPress plugin (versions up to and including 4.3.2.0) allows unauthenticated remote attackers to modify or tamper with data due to incorrectly configured access control security levels. The flaw, reported by Patchstack and tracked as CWE-862 (Missing Authorization), carries a CVSS 3.1 base score of 7.5 with an integrity-only impact; no public exploit identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the target WordPress site has the EventPrime plugin installed and active at a version up to and including 4.3.2.0, and that the site is reachable over the network - consistent with the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction and high integrity impact but no confidentiality or availability loss - a profile typical of state-changing endpoints (write, update, or delete operations) that lack authorization checks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the internet for WordPress sites running EventPrime ≤ 4.3.2.0 and sends a crafted HTTP request directly to the vulnerable plugin endpoint (typically an admin-ajax.php action or REST route) without authenticating. Because the handler omits the required capability check, the request is processed with privileges it should not have, allowing the attacker to modify event data, bookings, or plugin configuration on the target site. … |
| Remediation | Upgrade the EventPrime plugin to a version newer than 4.3.2.0 once the vendor publishes a fix - no vendor-released patched version is identified in the supplied data, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-2-0-broken-access-control-vulnerability) and the plugin's WordPress.org listing for an update notification. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations running EventPrime versions 4.3.2.0 or earlier and document deployment scope and operational criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated PHP Object Injection in the EventPrime event calendar plugin for WordPress (versions <= 4.3.2.1) allows
Insecure direct object reference in the EventPrime WordPress plugin (versions up to and including 4.3.0.0) allows authen
Stored or reflected cross-site scripting in the EventPrime WordPress plugin (versions <= 4.3.2.1) allows authenticated u
Share
External POC / Exploit Code
Leaving vuln.today