Unauthenticated PHP Object Injection in EventPrime by EventPrime
CVE-2026-42687

8.1HIGH

Key Information:

Vendor

WordPress
Status
Eventprime
Vendor
CVE Published:
15 June 2026

What is CVE-2026-42687?

An unauthenticated PHP Object Injection vulnerability exists in the EventPrime plugin for WordPress, affecting versions up to and including 4.3.2.1. This flaw allows attackers to manipulate data flow by injecting malicious objects, potentially triggering unintended behavior and compromising site integrity. Users of affected versions are strongly encouraged to apply the necessary updates to mitigate this security risk.

Affected Version(s)

EventPrime <= 4.3.2.1

References

https://patchstack.com/database/wordpress/plugin/eventpri...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hhhai | Patchstack Bug Bounty Program
.