Access Control Vulnerability in EventPrime by EventPrime
CVE-2026-25312

7.5HIGH

Key Information:

Vendor

WordPress
Status
Eventprime
Vendor
CVE Published:
19 March 2026

What is CVE-2026-25312?

The EventPrime plugin suffers from a missing authorization vulnerability that arises from incorrectly configured access control security levels. This flaw permits unauthorized users to bypass security measures, potentially leading to unauthorized access to sensitive functionalities within the application. Affected versions include EventPrime up to 4.2.8.3. It is crucial for users to ensure that proper authorization checks are implemented to prevent exploitation of this vulnerability.

Affected Version(s)

EventPrime 0 <= 4.2.8.3

References

https://patchstack.com/database/Wordpress/Plugin/eventpri...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dr. M Fahad Khan | Patchstack Bug Bounty Program
.