{"id":"CVE-2026-42691","kind":"vulnerability","aliases":["CVE-2026-42691"],"related":[],"title":"EventPrime WordPress calendar plugin: authorization bypass lets users abuse privileges","description":"Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.","summary":"The EventPrime event calendar plugin for WordPress has an authorization bypass caused by a user-controlled key, which allows privilege abuse. The sources say the flaw affects all versions through 4.3.6.0 and rate it medium (CVSS 5.4).","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-calendar","eventprime","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed EventPrime plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Treat any version through `4.3.6.0` as affected; the sources do not give a more precise check.","fix":null,"status":"open","published_at":"2026-10-29T15:17:23+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","triaged_at":"2026-10-29T15:26:47+00:00","updated_at":"2026-10-29T15:26:47+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:26:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"EventPrime WordPress calendar plugin: authorization bypass lets users abuse privileges","impact":"medium","summary":"The EventPrime event calendar plugin for WordPress has an authorization bypass caused by a user-controlled key, which allows privilege abuse. The sources say the flaw affects all versions through 4.3.6.0 and rate it medium (CVSS 5.4).","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","eventprime","event-calendar"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"users gain privileges they should not have","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-42691 for the vendor fix version and the exact vulnerable feature and required role.","how_to_check":"- Check the installed EventPrime plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Treat any version through `4.3.6.0` as affected; the sources do not give a more precise check.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the EventPrime event calendar plugin for WordPress at or below 4.3.6.0 may be exposed. The sources do not say which plugin features or roles trigger the bypass, so the exact conditions are unknown. Sites without the plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4105,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-42691':13A,16A '4.3.6.0':54B,86C '5.4':60B 'abus':9A,44B 'abuse.this':79C 'affect':50B,81C 'allow':42B,77C 'author':5A,32B,61C 'bypass':6A,33B,62C 'calendar':3A,19B,26B,75C 'caus':34B 'control':39B,66C 'cve':11A,14A 'cvss':59B 'event':18B,25B,74C 'event-calendar':17B 'eventprim':1A,20B,24B,70C,71C,73C,82C 'eventprime-event-calendar-manag':72C 'flaw':49B 'issu':80C 'key':40B,67C 'let':7A 'manag':76C 'medium':58B 'n/a':84C 'packag':21B 'plugin':4A,27B 'privileg':10A,43B,78C 'rate':56B 'say':47B 'sourc':46B 'user':8A,38B,65C 'user-control':37B,64C 'version':52B 'vulner':68C 'wordpress':2A,22B,29B","nicknames":[],"mitigations":[],"who_affected":"Sites running the EventPrime event calendar plugin for WordPress at or below 4.3.6.0 may be exposed. The sources do not say which plugin features or roles trigger the bypass, so the exact conditions are unknown. Sites without the plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42691","severity":null,"published_at":"2026-10-29T15:17:23+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","fetched_at":"2026-10-29T15:25:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}