PT-2026-2445 · WordPress · Eventprime – Events Calendar

Deadbee · Publicado 2026-01-13 · Atualizado 2026-01-13 · CVE-2025-14507

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress versions prior to 4.2.7.1

Description The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is susceptible to sensitive information disclosure via the REST API. An unauthenticated attacker can extract sensitive booking data, including user names, email addresses, ticket details, payment information, and order keys, when the API is enabled by an administrator. The vulnerability was partially addressed in version 4.2.7.0, but remained exploitable. The affected API endpoint is not specified. The vulnerable parameter is not specified.

Recommendations Update to version 4.2.7.1 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-14507

Produtos afetados

Eventprime – Events Calendar

Referências · 8

• https://plugins.trac.wordpress.org/changeset/3422587 · Nota
• https://twitter.com/VulmonFeeds/status/2011131977173209485 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3432454 · Nota
• https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L447 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/4b170ed1-72ee-40b6-9882-e978d630f6bb?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L651 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14507 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011082181037416669 · Publicação no Twitter