EventPrime EUVD-2026-39382

Requires a valid authenticated Subscriber-level account on the target WordPress site (CVSS PR:L) - exploitation is network-based with low complexity and no user interaction (AV:N/AC:L/UI:N). The practical limiting factors are: (1) the attacker must obtain Subscriber access, which is trivial on sites with open registration but a real barrier where registration is closed; and (2) successful escalation to code execution depends on an exploitable PHP POP gadget chain being present in WordPress core or other installed plugins - without a usable chain, impact may be limited to lower-severity object instantiation effects. Affected only on EventPrime versions <= 4.3.4.1.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high impact across confidentiality, integrity, and availability - consistent with object-injection bugs that can yield RCE. The key limiter is PR:L: the attacker must already hold a valid Subscriber-level account, so on sites where open self-registration is disabled the realistic attack surface narrows considerably; on sites allowing public registration (common for WordPress), this is effectively a near-unauthenticated path. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so probability-of-exploitation and automatability cannot be quantified here - the priority rests on the high CVSS and the well-understood severity of deserialization flaws rather than on confirmed exploitation signals. The CVSS C:H/I:H/A:H rating assumes a usable gadget chain exists; actual impact on a given deployment may be lower if no exploitable chain is loaded - this should be verified against the specific WordPress environment.

An attacker registers (or compromises) a Subscriber account on a WordPress site running EventPrime <= 4.3.4.1, then submits a crafted request containing a malicious serialized PHP object to a vulnerable plugin endpoint. When the plugin deserializes the input, an available gadget chain is triggered, potentially allowing the attacker to read sensitive data, alter site content, or execute code. No public proof-of-concept was identified in the provided data; exploitation is network-based with low complexity per the CVSS vector.