CVE-2026-118523 · Other
NO FIX YET · SEE WHAT TO DO
The EventPrime WordPress plugin before 4.3.6.1 leaves the built-in Pending Review post status public. An unauthenticated visitor can read posts, pages and other content that is waiting for review.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the EventPrime WordPress plugin before 4.3.6.1 are exposed, since unauthenticated visitors can view content awaiting review. Sites without this plugin, or running 4.3.6.1 or later, are not affected.
Not affected if plugin-not-installed, version-4.3.6.1-or-later
Who cares eventprime, wordpress
4.3.6.1.4.3.6.1 or later.The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.