Unauthorized Post Modification in EventPrime Plugin for WordPress
CVE-2026-1655

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Eventprime – Events Calendar, Bookings And Tickets
Vendor
CVE Published:
18 February 2026

What is CVE-2026-1655?

The EventPrime plugin for WordPress is susceptible to unauthorized post modification due to insufficient authorization checks. The vulnerability resides in the save_frontend_event_submission function, which allows authenticated users with Customer+ roles to manipulate the event_id parameter. This exploitation can lead to unauthorized changes in event posts created by administrators, as it fails to enforce ownership and capability checks adequately. Users are encouraged to review their plugin versions and implement necessary security measures to mitigate this risk.

Affected Version(s)

EventPrime – Events Calendar, Bookings and Tickets 0 <= 4.2.8.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/eventprime-eve...
https://plugins.trac.wordpress.org/browser/eventprime-eve...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supoj Polsawas
.