CVE-2026-42669
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.
Risk Assessment
Unauthorized users may gain access to functions or data that should be protected, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update the EventPrime plugin to version 4.3.2.1 or later if available.
Other vulnerabilities in EventPrime
See all- CVE-2026-42687High
There is a vulnerability in EventPrime versions up to 4.3.2.1 that allows unauthenticated PHP object injection.
- CVE-2026-42686High
There is a Cross Site Scripting (XSS) vulnerability affecting subscribers in EventPrime versions <= 4.3.2.1.
- CVE-2026-39518High
Versions of EventPrime <= 4.3.0.0 have a vulnerability related to Insecure Direct Object References (IDOR). This allows subscribers to access data they should not have permission to.
Original NVD description (English source)
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.