CVE-2026-118523
Received Received - Intake

Unauthenticated Content Exposure in EventPrime WordPress Plugin

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: WPScan

Description
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-118523
EUVD
EUVD-2026-116736

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown EventPrime 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the EventPrime WordPress plugin versions before 4.3.6.1. It allows unauthenticated users to view content marked as Pending Review, which should only be accessible to reviewers or administrators. This improper access control exposes sensitive data.

Detection Guidance

Check if unauthenticated users can access posts or pages with 'Pending Review' status by visiting URLs like /?post_type=any&post_status=pending. Use WordPress REST API requests to query pending posts without authentication.

Impact Analysis

Unauthenticated users could access draft posts, pages, or other content awaiting review. This may lead to exposure of sensitive information that was not intended for public view, potentially including confidential or proprietary data.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data to unauthorized users. GDPR and HIPAA require protection of personal and health information, respectively. Unauthorized access may result in data breaches and regulatory penalties.

Mitigation Strategies

Update the EventPrime plugin to version 4.3.6.1 or later immediately. If updating is not possible, disable the plugin temporarily until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118523. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...