The EventPrime plugin registers the ep_upload_file_media AJAX action as nopriv, meaning it is publicly accessible. No authentication or proper authorization checks are performed, even though a nonce is created and never enforced. This flaw allows an unauthenticated attacker to send a POST request to the endpoint and upload any image file to the WordPress uploads directory. The ability to place arbitrary files on the server can be leveraged for phishing, persistence, or defacement. If the server is configured to execute uploads, the attacker could potentially run code on the site; this possibility is inferred from the description and is not directly confirmed.

All WordPress installations running the EventPrime Events Calendar, Bookings and Tickets plugin version 4.2.8.4 or earlier are affected. Any site using these builds has the ep_upload_file_media endpoint exposed without authorization.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests real‑world exploitation is currently rare or undocumented. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw by sending a crafted POST request to http://<site>/wp-admin/admin-ajax.php without any authentication or additional prerequisites. The vulnerability allows arbitrary file upload, and while remote code execution is inferred if the server executes uploaded content, this outcome is not directly supported by the description.