Vulnerabilities / EventPrime / WPSEC-2026-0339
EventPrime <= 4.3.4.8 - Unauthenticated reCAPTCHA Bypass via Login and Registration Forms
Medium 5.3
CWE-358Fixed in 4.3.5.0
- ID
- WPSEC-2026-0339
- Plugin
- EventPrime – Events Calendar, Bookings, Tickets & AI (eventprime-event-calendar-management)
- Affected
- all versions before 4.3.5.0
- Remediation
- Update to 4.3.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-358
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- EventPrime on WPSec AttackSurface
- Fix released
- Published
Description
The EventPrime plugin for WordPress is vulnerable to a reCAPTCHA bypass on its front-end login and registration forms in all versions up to, and including, 4.3.4.8. This is due to the ep_handle_login() and ep_handle_registration() functions only verifying reCAPTCHA when the 'g-recaptcha-response' parameter is present in the request. This makes it possible for unauthenticated attackers to skip the reCAPTCHA check by omitting the parameter, enabling automated login attempts and bulk account registration through these forms on sites where the site owner has enabled reCAPTCHA protection.
References
- https://wpsec.com/vuln/WPSEC-2026-0339/
- https://plugins.svn.wordpress.org/eventprime-event-calendar-management/tags/4.3.5.0/
- https://wordpress.org/plugins/eventprime-event-calendar-management/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS