The vulnerability is a missing authorization flaw that permits unauthorized users to exploit improperly configured access control settings within the WordPress EventPrime plugin. This flaw allows attackers to gain elevated privileges and modify or delete event data, potentially compromising the integrity and confidentiality of the website's content. The issue is classified under CWE‑862 and carries a CVSS score of 8.8, indicating a high likelihood of causing significant operational damage if exploited.

The affected product is Metagauss EventPrime, a WordPress event calendar manager. Versions from the initial release up through 4.2.8.0 are vulnerable. Any WordPress site that has installed one of these plugin versions is subject to the risk.

The exploitation potential is high, as the CVSS score reflects, but the EPSS indicates a very low probability of exploitation in the wild (<1%). The vulnerability is not listed in CISA's KEV catalog, suggesting no current widespread active exploitation. The likely attack vector is via legitimate web requests to the plugin’s administrative endpoints; an attacker would typically need basic authenticated access to the WordPress installation and would then coerce the plugin into granting inappropriate capabilities. The impact is primarily privilege escalation and subsequent data tampering.