The EventPrime plugin for WordPress contains a missing authorization check in its save_frontend_event_submission function, allowing any authenticated Subscriber+ user with a valid nonce to alter the event_id parameter and update or delete events created by administrators. This flaw results in a loss of integrity for event content and can be leveraged to tamper with event details, schedules, or ownership. It is classified as CWE-862, a Missing Authorization vulnerability.

The vulnerability exists in all versions of the metagauss EventPrime plugin up to and including 4.2.8.4. Sites running any of these releases are affected and require attention.

The vulnerability has a CVSS score of 4.3 and an EPSS score of less than 1%, indicating a moderate severity level and a low to very low current exploitation probability. The attack requires that the attacker be an authenticated user with a valid nonce to trigger the vulnerable AJAX endpoint, suggesting an insider or compromised account scenario. Though the likelihood of exploitation is low, the impact—untrusted modification of event posts—warrants timely remediation.