The EventPrime plugin prior to version 4.3.0.1 is vulnerable to Insecure Direct Object References (IDOR). The flaw allows a subscriber to manipulate request parameters and gain unauthorized access to the data of other subscribers or protected resources. This can lead to disclosure of personal information and potentially allow further exploitation if the compromised data is used to elevate privileges or conduct phishing attacks.

WordPress sites running the EventPrime plugin version 4.3.0.0 or earlier. The vulnerability impacts all installations in which the plugin is activated, regardless of user role, because the IDOR is present in the subscriber workflow.

The CVSS score of 7.1 indicates a high severity. The EPSS score is less than 1%, suggesting that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is likely local to the site’s subscriber interface, and any authenticated or unprivileged subscriber could exploit the IDOR by crafting URLs or form submissions. The exploitation does not require elevated privileges, so a determined attacker can reach the flaw by simply navigating the site or sending crafted requests.