CVE-2026-118523 in EventPrime Plugin
Summary
by MITRE • 11/04/2026
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in versions of the EventPrime WordPress plugin prior to version 4.3.6.1 represents a significant failure in access control logic regarding post visibility states. Specifically, the flaw lies in how the application handles posts assigned the built-in Pending Review status within the WordPress content management system architecture. In standard WordPress operations, any content marked as pending review is intended to remain invisible to public visitors and unauthenticated users until an administrator explicitly publishes it. However, due to a coding oversight in this specific plugin version, these unpublished items are rendered accessible via direct URL requests or through queries that do not properly filter by post status for non-privileged roles. This behavior effectively bypasses the fundamental security boundary between draft content and public-facing material, allowing individuals without any authentication credentials to inspect sensitive information that was never intended for dissemination.
From a technical perspective, this issue stems from an improper implementation of query parameters or template tags when rendering event data. The plugin likely retrieves post objects using functions such as get_posts or WP_Query but fails to include the necessary meta queries or status exclusions in its SQL statements for unauthenticated requests. Consequently, the database returns records with a post_status value of pending along with published and private entries depending on specific configuration contexts. This lack of strict enforcement means that any user who can guess or discover the permalink structure associated with these events can access their full details including titles, descriptions, dates, locations, and potentially embedded media files. The absence of role-based checks during this retrieval process is a classic example of an insecure direct object reference where the application trusts client-side assumptions about visibility rather than enforcing server-side validation against user capabilities.
The operational impact of this vulnerability extends beyond mere information disclosure as it can facilitate further malicious activities if sensitive data is contained within these pending events. Attackers may exploit this exposure to gather intelligence on upcoming business meetings, internal project timelines, or confidential promotional strategies that were meant for private review only. Furthermore, in scenarios where event registrations require payment or personal details during the creation phase but are stored as drafts before final approval, there is a risk of exposing personally identifiable information if such data was inadvertently saved within those post fields. This aligns with CWE-200 which classifies this type of flaw under Information Exposure and specifically CWE-611 regarding Improper Restriction of XML External Entity References or more accurately in web contexts CWE-862 Missing Authorization where the application does not perform proper authorization checks before granting access to resources.
To mitigate this risk, immediate action is required by upgrading the EventPrime plugin to version 4.3.6.1 or later which addresses these permission logic errors. Administrators should also audit their WordPress installations for any custom code that might override default post visibility behaviors and ensure that all plugins are kept up-to-date with security patches released by developers. Implementing a Web Application Firewall can provide an additional layer of defense by blocking requests that attempt to access non-public content types based on known patterns, although this is not a substitute for fixing the root cause in the application code itself. Regular vulnerability scanning and penetration testing should be conducted periodically to identify similar misconfigurations across other plugins or themes installed within the environment ensuring comprehensive protection against unauthorized data exposure.