CVE-2026-118523 PUBLISHED

EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override

Assigner: WPScan
Reserved: 28.10.2026 Published: 04.11.2026 Updated: 04.11.2026

The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.

Product Status

Vendor Unknown
Product EventPrime
Versions Default: unaffected
  • affected from 0 to 4.3.6.1 (excl.)

Credits

  • wellknown.info finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE