CVE-2026-42691
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The EventPrime plugin up to version 4.3.6.0 contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization checks. This can lead to privilege abuse.
Risk Assessment
An attacker may use user-controlled keys to bypass authorization and gain elevated privileges, potentially resulting in unauthorized actions on the site.
Recommendation
Update EventPrime to a version newer than 4.3.6.0 as soon as it is available.
Other vulnerabilities in EventPrime
See all- CVE-2026-42687High
There is a vulnerability in EventPrime versions up to 4.3.2.1 that allows unauthenticated PHP object injection.
- CVE-2026-42686High
There is a Cross Site Scripting (XSS) vulnerability affecting subscribers in EventPrime versions <= 4.3.2.1.
- CVE-2026-39518High
Versions of EventPrime <= 4.3.0.0 have a vulnerability related to Insecure Direct Object References (IDOR). This allows subscribers to access data they should not have permission to.
- CVE-2026-42669High
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.
- CVE-2025-63007Medium
Vulnerability in the EventPrime plugin allows insertion of sensitive information into sent data, enabling an attacker to retrieve embedded sensitive data.
- CVE-2025-63006Medium
The EventPrime plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. Affects versions up to and including 4.2.4.1.
- CVE-2025-12498Medium
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS