PT-2026-2445 · WordPress · Eventprime – Events Calendar

Deadbee · Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-14507

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress versions prior to 4.2.7.1

Description The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is susceptible to sensitive information disclosure via the REST API. An unauthenticated attacker can extract sensitive booking data, including user names, email addresses, ticket details, payment information, and order keys, when the API is enabled by an administrator. The vulnerability was partially addressed in version 4.2.7.0, but remained exploitable. The affected API endpoint is not specified. The vulnerable parameter is not specified.

Recommendations Update to version 4.2.7.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-14507

Affected Products

Eventprime – Events Calendar

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14507 · Security Note
• https://plugins.trac.wordpress.org/changeset/3422587 · Note
• https://twitter.com/VulmonFeeds/status/2011131977173209485 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3432454 · Note
• https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L447 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4b170ed1-72ee-40b6-9882-e978d630f6bb?source=cve · Note
• https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/trunk/includes/class-eventprime-rest-api.php#L651 · Note
• https://twitter.com/CVEnew/status/2011082181037416669 · Twitter Post