CVE-2026-24380CWE-862

WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability

Medium · published January 22, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

⚠️ Oops! A missing authorization check in EventPrime could let unauthorized users peek behind the curtain! Think of it like a concert where anyone can waltz backstage without a badge — security levels were supposed to keep intruders out, but a misconfiguration left the door ajar. As a result, unauthorized users could potentially access sensitive event management functions, leading to data exposure, unauthorized changes, or even malicious activities. While the severity is medium, the consequences of unauthorized access could still be quite damaging to the integrity of your event calendar.

Put simply

Think of it like a concert where anyone can waltz backstage without a badge — security levels were supposed to keep intruders out, but a misconfiguration left the door ajar. This vulnerability arises from incorrectly configured access control security levels in Metagauss EventPrime, allowing users without proper permissions to exploit various functionalities in versions from n/a up to 4.2.8.0.

What to do

As a result, unauthorized users could potentially access sensitive event management functions, leading to data exposure, unauthorized changes, or even malicious activities. While the severity is medium, the consequences of unauthorized access could still be quite damaging to the integrity of your event calendar. To mitigate this issue, review and correct access control settings in your EventPrime installation. Ensure you update to the latest version of EventPrime to secure the application against unauthorized access. Regular audits of permissions can also help identify any potential oversights moving forward. You've got this! Follow these steps, and you'll bolster your EventPrime security in no time! 🛡️

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability
    cvelistv5