EUVD-2026-36835
GHSA-cr5x-4xrc-3jfr
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth network-reachable WordPress plugin endpoint (AV:N/PR:N/UI:N); AC:H because PHP object injection requires a usable gadget chain; full CIA impact via deserialization-driven code execution.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.
AnalysisAI
Unauthenticated PHP Object Injection in the EventPrime event calendar plugin for WordPress (versions <= 4.3.2.1) allows remote attackers to inject crafted serialized PHP objects that may trigger arbitrary deserialization-driven gadget chains, leading to potential remote code execution, file manipulation, or data tampering. The flaw is reachable without authentication but carries CVSS:3.1 AC:H, indicating non-trivial preconditions for successful exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Target must run the EventPrime (eventprime-event-calendar-management) WordPress plugin at version 4.3.2.1 or earlier with the vulnerable endpoint reachable over the network, and a usable POP gadget chain must exist in WordPress core or another installed plugin/theme on the target - this is the AC:H limiter, as PHP object injection without a gadget chain produces no impact. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed: CVSS base score 8.1 (High) reflects network reach (AV:N), no authentication (PR:N), no user interaction (UI:N), and full CIA impact, but AC:H indicates the attacker needs specialized conditions - most likely a viable gadget chain in the target environment, since PHP object injection by itself is inert without one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote unauthenticated attacker submits a crafted HTTP request to an EventPrime-exposed endpoint containing a serialized PHP object payload referencing a class whose magic methods trigger a destructive side effect - for example, a file-write or eval gadget supplied by another installed plugin. When the plugin deserializes the input, the gadget chain executes within the WordPress process, allowing the attacker to write a webshell, exfiltrate wp-config.php secrets, or alter database records. … |
| Remediation | Upstream fix available per Patchstack advisory; a patched version higher than 4.3.2.1 is implied but not independently confirmed from the provided data - administrators should consult the Patchstack entry (https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-2-1-php-object-injection-vulnerability) and the WordPress.org changelog for eventprime-event-calendar-management to confirm the exact fixed release and update immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
WITHIN 24 HOURS: Inventory all WordPress installations for EventPrime versions ≤4.3.2.1 using wp-cli 'wp plugin list' or WordPress Admin > Plugins page; document affected systems and priorities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today