EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure

mediumseverity

5.3CVSS score

0.5%likelihood of exploitation, next 30 days

41%of all CVEs are less likely

Readycheck to confirm it

EventPrime WordPress plugin < 4.3.6.1 contains a broken access control vulnerability caused by improper handling of Pending Review post status, letting unauthenticated users view non-public content awaiting review, exploit requires no authentication.

Impact

Unauthenticated users can view unpublished posts and pages, leading to information disclosure.

Fix

Update to version 4.3.6.1 or later.

How to confirm it

Send: GET /wp-json/wp/v2/statuses ; GET /?rest_route=/wp/v2/statuses
Positive when: status_code == 200 and contains(content_type, "json") and contains_all(body, "\"slug\":\"emexpired\"", "\"slug\":\"pending\"")

Run it with nuclei: nuclei -id CVE-2026-118523 -u <target>

The full check

id: CVE-2026-118523

info:
  name: EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure
  author: maulanawirawan
  severity: medium
  description: |
    EventPrime WordPress plugin < 4.3.6.1 contains a broken access control vulnerability caused by improper handling of Pending Review post status, letting unauthenticated users view non-public content awaiting review, exploit requires no authentication.
  impact: |
    Unauthenticated users can view unpublished posts and pages, leading to information disclosure.
  remediation: |
    Update to version 4.3.6.1 or later.
  reference:
    - https://wpscan.com/vulnerability/d3cdae3c-79a4-4daf-8fe4-b03cd589beb4/
    - https://plugins.trac.wordpress.org/changeset?old_path=/eventprime-event-calendar-management/tags/4.3.6.0&new_path=/eventprime-event-calendar-management/tags/4.3.6.1
    - https://nvd.nist.gov/vuln/detail/CVE-2026-118523
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-118523
    epss-score: 0.00467
    epss-percentile: 0.40768
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    vendor: eventprime
    product: eventprime-event-calendar-management
    fofa-query: body="eventprime-event-calendar-management"
  tags: cve,cve2026,wp,wordpress,wp-plugin,eventprime,disclosure,unauth

http:
  - raw:
      - |
        GET /wp-json/wp/v2/statuses HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /?rest_route=/wp/v2/statuses HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "\"slug\":\"emexpired\"", "\"slug\":\"pending\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from