PT-2026-20281 · WordPress · Eventprime

Supoj Polsawas · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-1655

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions EventPrime plugin for WordPress versions prior to 4.2.8.5

Description The EventPrime plugin for WordPress is susceptible to unauthorized post modification because of absent authorization checks. The save frontend event submission function accepts a user-controlled event id parameter and updates the corresponding event post without verifying ownership or capabilities. This allows authenticated attackers with Customer+ privileges to modify posts created by administrators by manipulating the event id parameter, provided they have a valid nonce.

Recommendations Update the EventPrime plugin to version 4.2.8.5 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1655

Affected Products

Eventprime

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-1655 · Security Note
• https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/tags/4.2.8.1/includes/class-ep-ajax.php#L741 · Note
• https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-ep-ajax.php#L741 · Note
• https://t.me/CVEtracker/44949 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3455239%40eventprime-event-calendar-management%2Ftrunk&old=3452796%40eventprime-event-calendar-management%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0e2a2769-1309-4aad-8411-4445efea2b66?source=cve · Note
• https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-ep-ajax.php#L798 · Note
• https://twitter.com/CVEnew/status/2024038167427387630 · Twitter Post
• https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/tags/4.2.8.1/includes/class-ep-ajax.php#L798 · Note
• https://twitter.com/VulmonFeeds/status/2024159059310530704 · Twitter Post