CVE-2026-42686

There is a vulnerability in EventPrime versions up to 4.3.2.1 that allows unauthenticated PHP object injection.

Versions of EventPrime <= 4.3.0.0 have a vulnerability related to Insecure Direct Object References (IDOR). This allows subscribers to access data they should not have permission to.

Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.

Vulnerability in the EventPrime plugin allows insertion of sensitive information into sent data, enabling an attacker to retrieve embedded sensitive data.

The EventPrime plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 4.2.4.1.

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.