CVE-2026-42669: WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability

Synopsis

A broken access control vulnerability affects the WordPress EventPrime plugin at version 4.3.2.0 and earlier. The flaw is reachable over the network with no authentication required and no user interaction needed, meaning any remote party can trigger it directly. Successful exploitation gives an attacker full write access to data controlled by the plugin, enabling unauthorized creation, modification, or deletion of event-related content. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress instance via HTTP or HTTPS.

• AuthenticationNot required

  No account or session credential of any kind is needed to exploit this vulnerability.

• Victim interactionNot required

  The attack completes without any action from an existing user or administrator of the site.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental prerequisites.

Blast Radius

• An unauthenticated attacker can write, modify, or delete event and booking data managed by the EventPrime plugin.
• Integrity of scheduled events, registrations, and plugin-persisted configuration records is fully compromised.
• No confidentiality or availability impact is indicated, so data exfiltration and service disruption are not direct outcomes of this vulnerability alone.