What the vulnerability does
01Description
The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4.2.8.4. This is due to the save_frontend_event_submission function accepting a user-controlled event_id parameter and updating the corresponding event post without enforcing ownership or capability checks. This makes it possible for authenticated (Customer+) attackers to modify posts created by administrators by manipulating the event_id parameter granted they can obtain a valid nonce.
Explanation of Vulnerability in Simple Terms
02Summary
EventPrime versions up to 4.2.8.4 lack proper authorization checks, allowing authenticated users to modify event data they should not have access to. An attacker with a low-privilege account can alter event information without the appropriate permissions. The vulnerability affects the plugin's core event management functionality and requires an active user account to exploit.
What an attacker can do
03Attacker Capabilities
Modify event details and settings without proper authorization.
Potential impact on your site
04Site Impact
Event data can be altered by unauthorized users, compromising event integrity and attendee information.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
February 18, 2026
CVE published
April 8, 2026
Record updated
