CVE-2026-42687: WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the EventPrime WordPress plugin (versions 4.3.2.1 and earlier) where attacker-controlled data is passed to PHP's unserialization functions without validation. The vulnerability is reachable over the network and requires no authentication, though exploitation depends on environmental conditions such as the presence of a usable gadget chain in the PHP class hierarchy. Successful exploitation gives an attacker full read access to sensitive data, the ability to modify stored content, and the ability to crash or destabilize the affected service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the target WordPress instance via HTTP/HTTPS.

• AuthenticationNot required

  No account or session credential of any kind is needed; the attacker sends a crafted unauthenticated request to trigger unserialization.

• Victim interactionNot required

  Exploitation is entirely server-side; no user action such as clicking a link or opening a file is involved.

• Attack complexityDetail

  Attack complexity is high because successful exploitation depends on the presence of a suitable PHP gadget chain in the target environment, introducing environmental factors outside the attacker's direct control.

Blast Radius

• Reads sensitive data stored in the WordPress database, including user credentials, session tokens, and plugin configuration.
• Modifies or deletes persisted database rows and filesystem content, including posts, options, and uploaded files.
• Executes arbitrary code on the server if a suitable gadget chain is available, giving full operating-system-level access.
• Crashes or destabilizes the PHP process, taking down the WordPress site and any co-hosted services.