CVE-2025-63006
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The EventPrime plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 4.2.4.1.
Risk Assessment
An unauthorized person may gain access to administrative functions or data they should not have access to, potentially leading to confidentiality and integrity breaches.
Recommendation
Update the EventPrime plugin to the latest available version that includes a fix for this vulnerability. Additionally, review the access control configuration to ensure it is correct.
Other vulnerabilities in EventPrime
See all- CVE-2026-42687High
There is a vulnerability in EventPrime versions up to 4.3.2.1 that allows unauthenticated PHP object injection.
- CVE-2026-42686High
There is a Cross Site Scripting (XSS) vulnerability affecting subscribers in EventPrime versions <= 4.3.2.1.
- CVE-2026-39518High
Versions of EventPrime <= 4.3.0.0 have a vulnerability related to Insecure Direct Object References (IDOR). This allows subscribers to access data they should not have permission to.
- CVE-2026-42669High
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.
- CVE-2025-63007Medium
Vulnerability in the EventPrime plugin allows insertion of sensitive information into sent data, enabling an attacker to retrieve embedded sensitive data.
- CVE-2025-12498Medium
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.
Original NVD description (English source)
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.4.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS