PT-2025-10026 · WordPress · Eventprime – Events Calendar

Tim Coen · Published 2025-03-07 · Updated 2025-08-12 · CVE-2024-13526

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress versions up to, and including, 4.0.7.3

Description The issue allows authenticated attackers with Subscriber-level access and above to access data without proper authorization. This is due to missing capability checks on the export submittion attendees function, enabling them to download the list of attendees for any event.

Recommendations For versions up to, and including, 4.0.7.3, consider disabling the export submittion attendees function until a patch is available to prevent unauthorized access to event attendee lists.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-13526

Affected Products

Eventprime – Events Calendar

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-13526 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13526 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/tags/4.0.7.3/includes/class-ep-ajax.php#L1903 · Note
• https://t.me/cvenotify/113772 · Telegram Post
• https://twitter.com/CVEnew/status/1897878632468496680 · Twitter Post
• https://twitter.com/CVETracker/status/1898101531087384713 · Twitter Post
• https://t.me/cveNotify/131873 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2be578d9-27c3-4a16-a634-1514ed97a1a2?source=cve · Note
• https://t.me/cvedetector/19772 · Telegram Post