CVE-2024-4665

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.

Score

CVSS 3.1 6.4 Medium

Status

Modified - contact@wpscan.com

Published

2025-05-15

Last modified

2025-11-13

Affected products

• Eventprime (Metagauss)
• Eventprime (Unknown)

References

• https://wpscan.com/vulnerability/50b78cac-cad1-4526-9655-ae0440739796/