CVE-2026-42691: WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and can exploit the issue over the network. No user interaction is required.

Q: What is the expected security impact if exploited?

The reported impact is limited to low integrity and low availability impact. No confidentiality impact is reported.

Published Oct 29, 2026

Updated

Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade eventprime-event-calendar-management to a version that resolves this vulnerability.
Fixed in 4.3.6.1

Event History

Oct 29, 2026

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and can exploit the issue over the network. No user interaction is required.

What is the expected security impact if exploited?