CVE-2024-1321 in EventPrime Plugin
Summary
by MITRE • 03/13/2024
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for unauthenticated attackers to book events for free.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The EventPrime plugin for WordPress represents a widely used solution for managing events, bookings, and ticketing within the WordPress ecosystem. This vulnerability affects all versions up to and including 3.4.2, creating a significant security risk for organizations relying on the plugin for event management and revenue generation. The flaw exists within the plugin's payment processing logic and demonstrates a critical failure in access control mechanisms that should prevent unauthorized modifications to financial transactions.
The technical flaw stems from insufficient authentication checks within the plugin's order processing system. Specifically, the vulnerability allows unauthenticated users to manipulate order payment statuses through direct API calls or form submissions that bypass normal authentication procedures. This occurs because the plugin does not properly validate user credentials or roles before accepting payment status updates, creating an authorization bypass condition that enables attackers to modify transaction records without proper authorization. The vulnerability operates at the application layer and specifically affects the plugin's handling of payment status transitions within the booking workflow.
The operational impact of this vulnerability extends beyond simple financial loss, as it fundamentally undermines the integrity of the event booking system. Attackers can exploit this flaw to create free bookings for events that should require payment, potentially resulting in revenue loss for event organizers and venue managers. The vulnerability affects all payment types supported by the plugin, including credit card transactions, PayPal payments, and other payment gateways that integrate with the system. Additionally, the unauthenticated nature of the attack means that malicious actors can repeatedly exploit this weakness without requiring any valid user credentials or accounts.
Organizations using the EventPrime plugin should immediately implement mitigation strategies to protect their systems from exploitation. The primary recommendation involves upgrading to the latest version of the plugin where this vulnerability has been addressed through proper authentication checks and access controls. Security teams should also implement network-level restrictions to limit access to plugin endpoints and monitor for unusual payment status changes. The vulnerability aligns with CWE-285, which addresses improper authorization issues, and corresponds to ATT&CK technique T1078 for valid accounts and T1566 for credential harvesting, though the specific vector here involves bypassing authentication rather than stealing credentials. System administrators should also consider implementing web application firewalls to detect and block suspicious requests targeting the vulnerable plugin endpoints.