The EventPrime plugin for WordPress can expose sensitive booking data—including user names, email addresses, ticket details, payment information, and order keys—through its REST API. When the API is enabled by an administrator, any unauthenticated user can retrieve this information, compromising the confidentiality of event participants and transactions. The flaw represents a common information leakage weakness, classified as CWE-200.

The vulnerability affects the EventPrime – Events Calendar, Bookings and Tickets plugin by metagauss, specifically all versions up to and including 4.2.7.0. It applies only when the REST API endpoint is enabled, a setting that can be configured by site administrators.

The CVSS score of 5.3 indicates moderate severity, while the EPSS of less than 1% suggests a low probability of exploitation at present. The issue is not listed in CISA’s KEV catalog. Attackers can gain unauthenticated access via the exposed REST API, potentially from any network location with internet reach to the site. The overall risk is moderate, primarily driven by the potential for widespread data exposure if the API remains enabled.