Medium severity · published Oct 29, 2026
CVE-2026-42691
WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability
New
5.4
CVSS
–
EPSS
No
On KEV
Description
Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
EventPrime · EventPrime
through 4.3.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42691
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42691
patchstack.com
https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-6-0-broken-access-control-vulnerability?_s_id=cve
More from EventPrime
8.8
CVE-2026-56053
WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability
8.1
CVE-2026-42687
WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability
7.5
CVE-2026-42669
WordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability
7.1
CVE-2026-42686
WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability
7.1
CVE-2026-39518
WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability