The EventPrime plugin contains a missing authorization flaw that lets an attacker complete payments without proper authentication. This flaw permits unauthorized payment actions, resulting in revenue loss, data integrity problems, and potential fraud. The weakness is rooted in an incorrectly configured access control security level and is identified as CWE‑862.

The vulnerability affects the WordPress EventPrime eventcalendar‑management plugin from Metagauss. All released versions through 4.2.8.3 are susceptible. Users running any of these versions on WordPress sites must upgrade to a newer release to remove the flaw.

Exploit probability is indicated as less than 1%, implying a low likelihood of automated exploitation. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited current exploitation. Likely exploitation would occur through the web interface, manipulating the payment endpoint in a way that bypasses the required authorization checks. The potential impact of accepting unauthorized payments represents a serious business risk.