Metagauss EventPrime for WordPress contains a broken access control flaw that allows a malicious actor to perform actions normally restricted to authorized users. The vulnerability can be leveraged to add, modify, or delete events and calendar data, potentially affecting the confidentiality, integrity, and availability of the site’s event management features. The weakness is identified as CWE-862, highlighting missing authorization checks.

The flaw is present in all releases of EventPrime up through version 4.2.6.0. Any WordPress site running this plugin version is potentially impacted.

The risk score of 7.5 indicates high severity, yet the estimated probability of exploitation is very low and there is no evidence of widespread attacks. Assuming an attacker can reach the plugin’s web endpoints, they could exploit the missing authorization controls without elevated credentials, making the attack vector likely remote and server-side. Successful exploitation would grant the attacker full administrative control over event data, but would not provide broader WordPress installation privileges unless combined with other weaknesses.