EventPrime – Events Calendar, Bookings and Tickets, CVE-2026-1655
- CVE, Research URL
- Published on
- Feb 18, 2026
- Research Description
- The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4.2.8.4. This is due to the save_frontend_event_submission function accepting a user-controlled event_id parameter and updating the corresponding event post without enforcing ownership or capability checks. This makes it possible for authenticated (Customer+) attackers to modify posts created by administrators by manipulating the event_id parameter granted they can obtain a valid nonce.
- Affected versions
-
max 4.2.8.5.
- Status
-
vulnerable