Object Injection Vulnerability in Metagauss EventPrime Event Calendar Management Plugin
CVE-2026-24378

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Eventprime
Vendor
CVE Published:
25 March 2026

What is CVE-2026-24378?

The Metagauss EventPrime Event Calendar Management plugin is susceptible to an Object Injection vulnerability due to improper deserialization of untrusted data. This allows attackers to potentially manipulate the application's behavior by crafting malicious inputs. This issue affects all versions of EventPrime up to and including 4.2.8.0, posing significant risks for systems relying on this plugin for event management functionalities.

Affected Version(s)

EventPrime 0 <= 4.2.8.0

References

https://patchstack.com/database/Wordpress/Plugin/eventpri...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO | Patchstack Bug Bounty Program
.