Live › vulnerability › CVE-2026-42691
The EventPrime event calendar plugin for WordPress has an authorization bypass caused by a user-controlled key, which allows privilege abuse. The sources say the flaw affects all versions through 4.3.6.0 and rate it medium (CVSS 5.4).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the EventPrime event calendar plugin for WordPress at or below 4.3.6.0 may be exposed. The sources do not say which plugin features or roles trigger the bypass, so the exact conditions are unknown. Sites without the plugin installed are not affected.
No product ranges from the sources yet.
4.3.6.0 as affected; the sources do not give a more precise check.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-42691")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.