WordPress Plugin Vulnerabilities

EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override

Description

The plugin does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.

Proof of Concept

Affects Plugins

Plugin icon
eventprime-event-calendar-management
Fixed in 4.3.6.1

References

CVE
CVE-2026-118523

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
wellknown.info
Submitter
wellknown.info
Submitter website
https://wellknown.info
Submitter twitter
wellknowninfo
Verified
Yes
WPVDB ID
d3cdae3c-79a4-4daf-8fe4-b03cd589beb4

Timeline

Publicly Published
2026-11-02 (about 1 day ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)

Other

Published
Title
Published
2026-03-13
Title
Doofinder for WooCommerce < 2.10.14 - Unauthenticated Information Exposure
Published
2024-07-26
Title
Campaign Monitor for WordPress < 2.8.16 - Unauthenticated Full Path Disclosure
Published
2024-08-12
Title
Order Export for WooCommerce < 3.24 - Unauthenticated Sensitive Information Exposure
Published
2026-08-19
Title
Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint
Published
2025-01-23
Title
RomethemeKit For Elementor < 1.5.3 - Contributor+ Sensitive Information Exposure via Elementor Templates