CVE-2026-118523: EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using EventPrime versions before 4.3.6.1 are exposed if they have posts, pages, or other content in the built-in Pending Review status. Unauthenticated visitors can view that pending content.
What does an attacker need to exploit it?
No authentication is required. The issue is an unintended public visibility override for content awaiting review.
How can I determine whether content may already be exposed?
Review the site for posts, pages, and other content assigned the Pending Review status while running an affected EventPrime version. Those items should be treated as potentially viewable by unauthenticated users.
What should be done if updating is not immediately possible?
Do not leave sensitive or unpublished material in Pending Review status on affected installations. Move it to a status that is not publicly accessible until EventPrime can be updated to 4.3.6.1 or later.