EventPrime <= 4.3.4.8 - Unauthenticated Information Exposure of Password-Protected Event Content via REST API and Abilities
- ID
- WPSEC-2026-0341
- Plugin
- EventPrime – Events Calendar, Bookings, Tickets & AI (eventprime-event-calendar-management)
- Affected
- from 4.2.4.0 before 4.3.5.0
- Remediation
- Update to 4.3.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- EventPrime on WPSec AttackSurface
- Fix released
- Published
Description
The EventPrime plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 4.2.4.0 to 4.3.4.8. This is due to the plugin's event formatter, used by its public REST event routes and by the 'eventprime/list-events' and 'eventprime/get-event' abilities, returning the full post content of password-protected events without checking whether the post password has been supplied. This makes it possible for unauthenticated attackers to read the content of password-protected events. The REST routes are only registered when the plugin's REST API setting is enabled; in version 4.3.4.8 the abilities expose the same data on WordPress 6.9 and later without that setting.
References
- https://wpsec.com/vuln/WPSEC-2026-0341/
- https://plugins.svn.wordpress.org/eventprime-event-calendar-management/tags/4.3.5.0/
- https://wordpress.org/plugins/eventprime-event-calendar-management/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS