EventPrime <= 4.3.4.8 - Missing Authorization to Unauthenticated Booking and User Account Creation via 'eventprime/create-booking' Ability
- ID
- WPSEC-2026-0340
- Plugin
- EventPrime – Events Calendar, Bookings, Tickets & AI (eventprime-event-calendar-management)
- Affected
- from 4.3.4.8 before 4.3.5.0
- Remediation
- Update to 4.3.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- EventPrime on WPSec AttackSurface
- Fix released
- Published
Description
The EventPrime plugin for WordPress is vulnerable to unauthorized booking and user account creation in version 4.3.4.8. This is due to the 'eventprime/create-booking' ability, registered with the WordPress Abilities API, using a permission callback that always returns true and calling the plugin's REST booking handler directly, so the plugin's REST access policy is never applied. On WordPress 6.9 and later, this makes it possible for unauthenticated attackers to create bookings for any event with an attacker-chosen status (completed by default) and no payment, attach bookings to any existing user by email address, and create new WordPress user accounts for arbitrary email addresses even when user registration is disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0340/
- https://plugins.svn.wordpress.org/eventprime-event-calendar-management/tags/4.3.5.0/
- https://wordpress.org/plugins/eventprime-event-calendar-management/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS